@browserbridge/bbx 1.7.7 → 1.7.8

package/PRIVACY.md

@@ -0,0 +1,92 @@
+# Browser Bridge (BBX) Privacy Policy
+
+Last updated: 2026-03-27
+
+## Overview
+
+Browser Bridge is a developer tool that lets a user-approved local agent inspect and interact with web pages in an explicitly enabled Chrome window. This policy describes how Browser Bridge handles data.
+
+## What Browser Bridge can access
+
+When you enable Browser Bridge for a Chrome window, Browser Bridge can access page data from tabs in that window as needed to fulfill your requests. Depending on the action you or your connected agent triggers, this can include:
+
+- Page metadata such as URL, title, viewport, and scroll position
+- DOM structure, element attributes, visible text, and layout information
+- Computed styles, matched rules, and accessibility-tree data
+- Console messages and uncaught page errors
+- Network request metadata captured from page `fetch` and `XMLHttpRequest` activity, such as URL, method, status, timing, and size
+- `localStorage` and `sessionStorage` values when explicitly requested
+- Screenshots or cropped image captures when explicitly requested
+- User-triggered interaction data such as clicks, typing, key presses, selection changes, and navigation actions
+
+Browser Bridge is designed for local debugging and automation of the browser state you intentionally expose to it.
+
+## How Browser Bridge uses data
+
+Browser Bridge uses this data only to provide its user-facing purpose: letting you inspect, test, and patch the currently enabled browser window from a connected developer tool or agent.
+
+The extension sends request and response data locally through:
+
+1. The Browser Bridge Chrome extension
+2. The Browser Bridge native messaging host running on your machine
+3. The local agent client or IDE that you intentionally connect
+
+Browser Bridge does not operate a Browser Bridge cloud service and does not send extension data to developer-operated remote servers.
+
+## Sharing and downstream processing
+
+Browser Bridge shares page data only with the local companion components and local client you choose to connect.
+
+Important:
+
+- Browser Bridge itself does not sell your data.
+- Browser Bridge itself does not use your data for advertising.
+- Browser Bridge itself does not transfer page data to Browser Bridge-operated remote infrastructure.
+- Your connected agent or IDE may, depending on its own configuration and provider, forward prompts, tool calls, or tool results to remote services. That downstream handling is controlled by the connected product, not by Browser Bridge.
+
+You should review the privacy and retention practices of any connected agent, IDE, or model provider you use with Browser Bridge.
+
+## Data retention
+
+Browser Bridge keeps data only as long as needed for the current local session and feature behavior.
+
+- Window enablement state is stored in session storage and cleared when disabled or when the browser session ends.
+- Action log entries are stored for the current browser session only.
+- Console and network buffers are bounded in memory and cleared when disabled or when the page state is reset.
+- Patch state and remembered element references are session-scoped and cleared on disable, page replacement, or navigation as needed.
+
+Browser Bridge does not provide Browser Bridge-hosted accounts, sync, or long-term server-side storage.
+
+## User control
+
+You control when Browser Bridge can access browser data.
+
+- Access is off by default.
+- You explicitly enable Browser Bridge for a Chrome window.
+- You can disable it at any time.
+- Restricted Chrome pages are not scriptable through Browser Bridge.
+
+## Remote code and runtime evaluation
+
+Browser Bridge does not load remotely hosted extension code.
+
+Browser Bridge can, when you explicitly invoke features such as page evaluation, execute user-requested expressions in the inspected page context through Chrome's documented Debugger API. That execution affects only the currently enabled browser window and is part of Browser Bridge's developer-tool functionality.
+
+## Security
+
+- Extension code is packaged with the extension; Browser Bridge does not fetch and execute remote extension scripts.
+- Communication with the companion host uses Chrome Native Messaging.
+- Access is limited to the explicitly enabled browser window.
+- The extension includes bounded buffers and session-scoped rollback for temporary page patches.
+
+## Chrome Web Store Limited Use statement
+
+The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
+
+## Changes
+
+If Browser Bridge's data practices change, this policy will be updated before those changes are released.
+
+## Contact
+
+- GitHub Issues: https://github.com/koltyakov/browser-bridge/issues

package/README.md

@@ -143,6 +143,10 @@ Browser Bridge itself routes extension data locally through the Chrome extension
 
 Your connected agent or IDE may still forward tool calls or tool results to remote services under that product's own settings and privacy policy. See [PRIVACY.md](https://github.com/koltyakov/browser-bridge/blob/main/PRIVACY.md) for the Browser Bridge policy.
 
+## Responsible Use
+
+Browser Bridge is intended for local development, debugging, and testing of web resources you own, control, or are explicitly authorized to test. Do not use it for web scraping, unauthorized data collection, or impersonating or acting as another user. You are responsible for the agents you connect, the actions they perform, and compliance with applicable laws, permissions, website terms, and third-party rights. See the [Responsible Use Agreement](https://github.com/koltyakov/browser-bridge/blob/main/RESPONSIBLE_USE.md).
+
 ## License
 
 MIT. See [LICENSE](https://github.com/koltyakov/browser-bridge/blob/main/LICENSE).

package/RESPONSIBLE_USE.md

@@ -0,0 +1,16 @@
+# Browser Bridge (BBX) Responsible Use Agreement
+
+Last updated: 2026-07-22
+
+Browser Bridge is intended for local development, debugging, and testing of websites, applications, and other web resources that you own, control, or have explicit permission to test.
+
+By using Browser Bridge, you agree that you will not use it to:
+
+- Scrape websites or perform bulk, automated, or unauthorized data collection.
+- Impersonate another user or act through another person's identity, credentials, account, or authenticated session without their explicit authorization.
+- Access systems or data without authorization, bypass access controls, violate privacy, or perform deceptive, fraudulent, abusive, or harmful actions.
+- Violate applicable laws, regulations, contractual obligations, website terms, or third-party rights.
+
+You are responsible for the browser windows you enable, the agents and services you connect, the instructions and actions they perform, the data they access or transmit, and any resulting impact. You must obtain all necessary permissions and consent and review the privacy and security practices of connected agents, IDEs, and model providers.
+
+Use Browser Bridge fairly, lawfully, and only within an authorized scope. This agreement does not modify the project's [MIT License](./LICENSE).

package/SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+Browser Bridge gives coding agents structured access to a real browser profile. The daemon,
+native messaging host, Chrome extension, CLI, and MCP server are all part of the trusted
+path between an agent and the user's browser, so security reports are taken seriously.
+
+## Supported Versions
+
+Only the latest version published to npm (`@browserbridge/bbx`) and the Chrome Web Store
+receives security fixes. Older versions are not patched retroactively; upgrade to the
+latest release before reporting.
+
+## Reporting a Vulnerability
+
+Please do **not** open a public GitHub issue for security vulnerabilities.
+
+Report privately via GitHub's security advisory form:
+<https://github.com/koltyakov/browser-bridge/security/advisories/new>
+
+Include the affected component (daemon, native host, extension, CLI, MCP server), a
+reproduction, and the impact you believe it has. Reports are acknowledged as quickly as
+possible; fixes for confirmed vulnerabilities are prioritized over regular development.
+
+## Scope
+
+In scope:
+
+- The bridge daemon: transport auth (socket permissions, TCP auth token), request routing,
+  and the opt-in proxy/remote mode.
+- The native messaging host and its manifest installation.
+- The Chrome extension (MV3 service worker, content scripts, CDP usage).
+- The `bbx` CLI and MCP server, including config/skill installation paths.
+
+Out of scope:
+
+- Vulnerabilities in Chrome, Node.js, or other dependencies (report upstream).
+- Issues requiring an already-compromised machine or browser profile.
+- The inherent capability of the tool itself: an agent authorized to use Browser Bridge
+  can, by design, read and manipulate pages in the connected browser profile. See
+  [PRIVACY.md](https://github.com/koltyakov/browser-bridge/blob/main/PRIVACY.md) and
+  [docs/agent-permissions.md](https://github.com/koltyakov/browser-bridge/blob/main/docs/agent-permissions.md)
+  for the intended trust model.
+
+## Design Notes
+
+- By default the daemon listens on a user-owned Unix socket (mode `0700` directory) or,
+  on Windows, a named pipe / localhost TCP.
+- Any TCP listener requires a random 256-bit auth token stored with mode `0600`;
+  registration without it is rejected and the comparison is constant-time.
+- Proxy mode (LAN exposure) is opt-in via `bbx proxy enable` and always provisions a
+  token; an invalid `bindHost` in the config rejects the config rather than widening
+  the bind address.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserbridge/bbx",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "private": false,
   "keywords": [
     "agent-tools",
@@ -33,7 +33,10 @@
   },
   "files": [
     "LICENSE",
+    "PRIVACY.md",
+    "RESPONSIBLE_USE.md",
     "README.md",
+    "SECURITY.md",
     "packages/agent-client/src",
     "packages/mcp-server/src",
     "packages/native-host/bin",