@btraut/browser-bridge 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -6,6 +6,36 @@ The format is based on "Keep a Changelog", and this project adheres to Semantic
 
 ## [Unreleased]
 
+### Added
+
+### Changed
+
+### Fixed
+
+## [0.15.0] - 2026-03-21
+
+### Added
+
+- Added first-class `permissions.*` support across Core, CLI, and MCP for reading allowlist/mode state and requesting allowlist/mode changes through a human approval flow in Chrome.
+- Added a repo-local `dev:loop` helper plus a matching local `dev-loop` skill for Browser Bridge contributors, so extension rebuild/relaunch/bypass setup can run from one command instead of the usual Chrome nonsense.
+
+### Changed
+
+- The repo-local `bump-version` release skill and release doc now require a fresh `npm install` and `npm run build` before any version bumping, so releases start from a clean build instead of wishful thinking.
+- External permission changes are now approval-gated end to end: CLI/MCP can request them, but the extension applies them only after a human approves a dedicated prompt, with extra friction for bypass mode.
+
+### Fixed
+
+- Cold-start extension attach is less brittle: Core now waits briefly for the extension handshake before failing drive and permissions calls with `EXTENSION_DISCONNECTED`, which cuts down false startup misses right after Chrome/runtime reconnects.
+- `drive.click` now retries a few transient locator-resolution misses instead of giving up after one wobble, which makes toggle/action controls like ManaVault's `Edit list` less likely to fail during live rerenders.
+- Interactive AX snapshots now prune hover-hidden controls that fail live DOM visibility and pointer-event checks, so inspect stops advertising inert ManaVault-style quantity buttons as actionable.
+- `dev enable-inspect` now retries transient stale diagnostics before failing, which cuts down false "inspect unavailable" reports while the extension handshake and capability negotiation are still catching up.
+- Locator ranking now prefers directly hittable exact matches over merely visible duplicates, so drive clicks are less likely to land on ghost controls that share an `aria-label` but are occluded or inert.
+- Repo-local Codex skills now live under `.agents/skills`, and the CLI install/prepack flow now reads from that canonical repo path instead of the dead `skills/` directory.
+- Existing tabs now recover their content script on demand after extension updates, so `drive.wait_for` and other tab actions stop dying with `Receiving end does not exist` just because the tab predates the current build.
+- Inspect now evaluates in an isolated world on the top frame when available, which makes auth/passkey pages less likely to derail `extract_content`, `page_state`, and `evaluate` with extension-surface debugger context errors.
+- Inspect reads are less flaky and less noisy: `extract_content` now defaults to quiesced capture, `page_state` is summary-first with redacted values by default, and `console_list` filters stale pre-session history unless you ask for older entries explicitly.
+
 ## [0.14.0] - 2026-03-13
 
 ### Added

package/README.md

@@ -51,6 +51,14 @@ Then load the unpacked extension from `packages/extension/`.
 
 Repo contributors: run `npm run hooks:install` once after clone. This repo expects `core.hooksPath=.githooks` so local `pre-commit` and `pre-push` block the same format/lint/typecheck failures that CI enforces.
 
+Repo contributors who are iterating on the extension should stop doing the manual delete/reinstall routine. Use:
+
+```bash
+npm run dev:loop -- --open-options
+```
+
+That rebuilds the workspace, uses macOS UI scripting to open `chrome://extensions` in your existing Chrome profile, clicks **Update** to reload unpacked extensions, waits for Browser Bridge to reconnect, and requests bypass mode if Chrome is still granular. Add `--install` only when dependencies changed.
+
 4. Try it:
 
 ```text
@@ -130,6 +138,14 @@ Manage approvals (and bypass mode):
 - Switch **Permission mode** to **Bypass (dangerous)** to skip the allowlist and prompts entirely.
 - In bypass mode, the agent can take actions on any website without asking.
 - Restricted URLs (for example `chrome://` and `file://`) are still blocked.
+- CLI and MCP can also inspect or request permission changes:
+  - Reads: `browser-bridge permissions list`, `browser-bridge permissions mode`, `browser-bridge permissions pending`
+  - Requests: `browser-bridge permissions allow-site --site example.com`, `revoke-site --site example.com`, `set-mode --mode granular|bypass`
+  - Equivalent MCP tools exist under `permissions.*`
+- External permission-change requests are still human-gated:
+  - CLI/MCP request calls open a dedicated Chrome approval prompt.
+  - Nothing is mutated silently from CLI or MCP.
+  - If the request times out, the command/tool returns `status: "timed_out"`; if the prompt is still open, a later human approval still applies the change.
 - `inspect.*` should already be enabled in current builds. Use `browser-bridge dev enable-inspect` as a diagnostics probe; if it reports missing inspect capability, treat that as stale runtime drift and reload or update the Browser Bridge extension.
 
 </details>
@@ -148,6 +164,15 @@ The CLI mirrors the MCP tool surface.
 - `session.recover`
 - `session.close`
 
+**permissions**
+
+- `permissions.list`
+- `permissions.get_mode`
+- `permissions.list_pending_requests`
+- `permissions.request_allow_site`
+- `permissions.request_revoke_site`
+- `permissions.request_set_mode`
+
 **drive**
 
 - `drive.navigate`
@@ -212,8 +237,8 @@ Or copy the Browser Bridge skill into your agent skills directory (advanced):
 
 ```bash
 # From this repo:
-# cp -R skills/browser-bridge ~/.agents/skills/browser-bridge
-# cp -R skills/browser-bridge ~/.claude/skills/browser-bridge
+# cp -R .agents/skills/browser-bridge ~/.agents/skills/browser-bridge
+# cp -R .agents/skills/browser-bridge ~/.claude/skills/browser-bridge
 
 # From npm (global install):
 cp -R "$(npm root -g)/@btraut/browser-bridge/skills/browser-bridge" ~/.agents/skills/browser-bridge