@magicbeansai/magicvault-win32-x64 0.9.0

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 MagicBeansAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundle.json

@@ -0,0 +1,82 @@
+{
+  "format_version": 1,
+  "version": "0.9.0",
+  "platform": "win32-x64",
+  "files": {
+    "bin/magicvault.exe": {
+      "sha256": "95e27b5408b5bc10541f5cdf8d5be6d467ada6025ae8fc5142144528ef8d2245",
+      "bytes": 9396224,
+      "executable": true
+    },
+    "bin/magicvault-mcp.exe": {
+      "sha256": "cad776f2bbb66a5fd6478268620dd4c7ede271d72d28b21b67e7d91cf978abbe",
+      "bytes": 4297728,
+      "executable": true
+    },
+    "bin/magicvault-native-host.exe": {
+      "sha256": "5d09a5d00f20b54614096b2022f85c7f03b36dc2df09140f74daff578c3529b6",
+      "bytes": 2157056,
+      "executable": true
+    },
+    "bin/magicvault-prompt.exe": {
+      "sha256": "fea9e6286f3905c9088cbaf0eaa70e2a86a77ff116c85f8cfdc4827c80f963e2",
+      "bytes": 4894720,
+      "executable": true
+    },
+    "extension/manifest.json": {
+      "sha256": "bcc73a79017ffa7c9e8c73716b6537e0cc2aeeba62786c7414100924b5e3bf51",
+      "bytes": 1088,
+      "executable": false
+    },
+    "extension/worker.js": {
+      "sha256": "b4b648141545d4ac0357968cf65ed7ceb9b6adb6f81e6fbe19612b95ad352b58",
+      "bytes": 22362,
+      "executable": false
+    },
+    "extension/options.html": {
+      "sha256": "2e5cdcdeb532697058357d1a01022e668c653bcc106c5e715feeb7caf77821e0",
+      "bytes": 5075,
+      "executable": false
+    },
+    "extension/options.js": {
+      "sha256": "64410d261bd552029590a85aaf098f0914b768cffdaabafc4286a74b1868c6af",
+      "bytes": 9385,
+      "executable": false
+    },
+    "extension/options.css": {
+      "sha256": "529df3a87d0985c60068454c32d85363f72fb9bf0628de894b4329830acd9028",
+      "bytes": 2359,
+      "executable": false
+    },
+    "extension/fill.js": {
+      "sha256": "845eb1f035560e5b97b40d72b4efb400db04cd66e8458bc54b06b542b2924be2",
+      "bytes": 3277,
+      "executable": false
+    },
+    "examples/secure-fill.json": {
+      "sha256": "9a88d93f6a56f2e91d7b82cbe194f77db2548dd66c045e79e391f536e4a352d3",
+      "bytes": 354,
+      "executable": false
+    },
+    "examples/http-profile.json": {
+      "sha256": "0ba5f9691a5493e42fe80907f9c4fa9231c550a6c1d3c5cc8e03aa1106fdeac1",
+      "bytes": 610,
+      "executable": false
+    },
+    "examples/process-profile.json": {
+      "sha256": "d5c8aa6be5a19ee433e819f43ef40078d7b1c101782d2e6fe29449943dfa443a",
+      "bytes": 551,
+      "executable": false
+    },
+    "LICENSE-MIT": {
+      "sha256": "b224b77c65d9e6598c8ffea5d0aa5412c8e1ab98b37436c0b7c1a68211e015d2",
+      "bytes": 1074,
+      "executable": false
+    },
+    "LICENSE-APACHE": {
+      "sha256": "a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5",
+      "bytes": 10849,
+      "executable": false
+    }
+  }
+}

package/examples/http-profile.json

@@ -0,0 +1,22 @@
+{
+  "label": "Example API request",
+  "destination": {
+    "kind": "http",
+    "config": {
+      "url": "https://api.example.com/v1/action",
+      "method": "POST",
+      "headers": [{
+        "name": "Authorization",
+        "value": {
+          "kind": "credential",
+          "credential_ref": "cred_00000000-0000-0000-0000-000000000000",
+          "credential_field": "password",
+          "prefix": "Bearer "
+        }
+      }],
+      "query": [],
+      "body": {"kind": "json", "value": [{"name": "action", "value": {"kind": "literal", "value": "synthetic-demo"}}]},
+      "timeout_secs": 15
+    }
+  }
+}

package/examples/process-profile.json

@@ -0,0 +1,21 @@
+{
+  "label": "Example trusted command",
+  "destination": {
+    "kind": "process",
+    "config": {
+      "executable": "/absolute/path/to/trusted-recipient",
+      "arguments": [],
+      "working_directory": "/absolute/path/to/trusted-work-directory",
+      "environment": [{
+        "name": "SERVICE_TOKEN",
+        "value": {
+          "kind": "credential",
+          "credential_ref": "cred_00000000-0000-0000-0000-000000000000",
+          "credential_field": "password"
+        }
+      }],
+      "stdin": null,
+      "timeout_secs": 15
+    }
+  }
+}

package/examples/secure-fill.json

@@ -0,0 +1,12 @@
+{
+  "operation_id": "22222222-2222-4222-8222-222222222222",
+  "browser_handle": "33333333-3333-4333-8333-333333333333",
+  "target_handle": "44444444-4444-4444-8444-444444444444",
+  "fields": [
+    {
+      "css": "input[name=password]",
+      "credential_ref": "cred_11111111-1111-4111-8111-111111111111",
+      "credential_field": "password"
+    }
+  ]
+}

package/extension/fill.js

@@ -0,0 +1,59 @@
+function magicvaultFill(expectedOrigin, fields) {
+  if (!Array.isArray(fields) || fields.length === 0 || fields.length > 8)
+    return {fields: [], error: "invalid_request"};
+  const result = fields.map(() => "not_filled");
+  const fail = (error) => ({fields: result, error});
+  const usable = (node, value) => node instanceof HTMLInputElement &&
+    ["text", "password", "email", "tel", "url", "search"].includes(node.type) &&
+    !node.disabled && !node.matches(":disabled") && !node.readOnly && node.isConnected &&
+    node.getClientRects().length > 0 && getComputedStyle(node).visibility === "visible" &&
+    !node.closest("[inert]") && (node.maxLength < 0 || value.length <= node.maxLength);
+  try {
+    // URL origin alone does not establish a document's security origin (for
+    // example, a sandboxed opaque document can retain an HTTPS location).
+    if (globalThis.origin !== expectedOrigin || location.origin !== expectedOrigin ||
+        document.prerendering || !document.defaultView)
+      return fail("stale_target");
+    if (!Array.isArray(fields) || fields.length === 0 || fields.length > 8)
+      return fail("invalid_request");
+    const nodes = [];
+    // Resolve and validate every field before writing any material.
+    for (const field of fields) {
+      if (typeof field.css !== "string" || field.css.length > 512 ||
+          typeof field.value !== "string" || field.value.length === 0 || field.value.length > 4096)
+        return fail("invalid_request");
+      let matches;
+      try { matches = document.querySelectorAll(field.css); }
+      catch (_) { return fail("unsupported_target"); }
+      if (matches.length !== 1) return fail(matches.length ? "ambiguous_target" : "stale_target");
+      const node = matches[0];
+      if (!usable(node, field.value))
+        return fail("unsupported_target");
+      if (nodes.includes(node)) return fail("ambiguous_target");
+      nodes.push(node);
+    }
+    const setValue = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value").set;
+    for (let index = 0; index < nodes.length; index++) {
+      const node = nodes[index];
+      // Earlier input/change handlers may replace or detach a later field.
+      const matches = document.querySelectorAll(fields[index].css);
+      if (globalThis.origin !== expectedOrigin || location.origin !== expectedOrigin || !node.isConnected ||
+          matches.length !== 1 || matches[0] !== node || node.disabled || node.readOnly)
+        return fail("stale_target");
+      if (!usable(node, fields[index].value)) return fail("unsupported_target");
+      // A setter/event exception can follow a write. Never imply rollback.
+      result[index] = "uncertain";
+      setValue.call(node, fields[index].value);
+      node.dispatchEvent(new Event("input", {bubbles: true, composed: true}));
+      node.dispatchEvent(new Event("change", {bubbles: true}));
+      if (!node.isConnected || node.value !== fields[index].value) return fail("stale_target");
+      result[index] = "filled";
+    }
+    return {fields: result, error: null};
+  } catch (_) {
+    return fail("unavailable");
+  } finally {
+    // Best effort lifetime reduction, not a JS heap erasure guarantee.
+    for (const field of fields) if (field && typeof field === "object") field.value = "";
+  }
+}

package/extension/manifest.json

@@ -0,0 +1,14 @@
+{
+  "manifest_version": 3,
+  "name": "MagicVault — credential fills",
+  "version": "0.6.1",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+1KIVs/EvE8w/iSpAJX9nIzfnMlj5kn+q8O/7tHKLLDH/S3OjoAqDBS94CGnUu4HyTufTg34++DVVBsVLpKifIj1Do4gPxeNZX9IlVYvzjpvkjimvT+NDdC4P5JX5ydvgBcmEk+qmMsDtbHW0Afyt+/OnYjzbeMjMz+fbZ4y1IcparR2WR9uQ4pa7CguPnC06ekX0Ek8+f76K2ap7AKuMc4ChFvFwW2ib9NeMOUZxnwFC33YmH40Q38uMZZ7VUe6xvftATeCkI0GUZOFCF2ezxz1KVv1tBR995Bht5UVJw5/bgGoS748nOPtksCDmauURSPHTomNm15Fikjzsb3AQIDAQAB",
+  "minimum_chrome_version": "120",
+  "description": "Fill approved credential fields without putting values in agent messages. Requires the MagicVault native host.",
+  "permissions": ["nativeMessaging", "scripting", "webNavigation", "storage", "alarms"],
+  "optional_host_permissions": ["https://*/*", "http://localhost/*", "http://127.0.0.1/*"],
+  "background": {"service_worker": "worker.js"},
+  "options_page": "options.html",
+  "action": {"default_title": "MagicVault setup"},
+  "content_security_policy": {"extension_pages": "script-src 'self'; object-src 'none'; base-uri 'none'"}
+}

package/extension/options.css

@@ -0,0 +1,25 @@
+:root { color-scheme: light dark; font: 16px/1.6 system-ui, sans-serif; }
+body { margin: 0; } main { max-width: 760px; margin: 3rem auto; padding: 0 1.5rem 3rem; }
+h1 { font-size: 2rem; } h2 { margin-top: 2rem; font-size: 1.2rem; }
+label { display: block; } input { width: min(90%, 500px); padding: .5rem; margin: .5rem 0; }
+button { padding: .5rem .8rem; margin: .4rem .5rem .4rem 0; cursor: pointer; }
+code, #granted-sites { overflow-wrap: anywhere; } [role=status] { min-height: 1.6em; }
+select { width: min(100%, 550px); padding: .5rem; } button:disabled { cursor: default; }
+h3 { font-size: 1rem; margin-top: 1.5rem; }
+.identity-chip { display: inline-flex; flex-wrap: wrap; align-items: center; gap: .4rem .8rem; max-width: 100%; box-sizing: border-box; padding: .7rem 1rem; border: 1px solid #a5b4fc; border-radius: 1.2rem; background: #eef2ff; color: #312e81; box-shadow: 0 2px 6px rgb(49 46 129 / 10%); }
+.identity-label { font: 600 .75rem/1.5 system-ui, sans-serif; text-transform: uppercase; letter-spacing: .04em; }
+#extension-id { min-width: 0; max-width: 100%; font-size: .95rem; font-weight: 600; user-select: all; cursor: text; }
+#extension-id:focus-visible { outline: 2px solid currentColor; outline-offset: 4px; border-radius: .2rem; }
+.access-summary { display: grid; gap: .25rem; border: 2px solid #64748b; border-radius: .6rem; padding: 1rem; background: #f1f5f9; color: #1e293b; }
+.access-label { font-size: .8rem; font-weight: 600; text-transform: uppercase; letter-spacing: .04em; }
+#access-mode { font-size: 1.25rem; }
+.access-summary[data-state="all"] { border-color: #15803d; background: #f0fdf4; color: #14532d; }
+.access-summary[data-state="selected"] { border-color: #1d4ed8; background: #eff6ff; color: #1e3a8a; }
+.access-summary[data-state="unknown"] { border-color: #a16207; background: #fefce8; color: #713f12; }
+@media (prefers-color-scheme: dark) {
+  .identity-chip { border-color: #818cf8; background: #1e1b4b; color: #e0e7ff; }
+  .access-summary { background: #1e293b; color: #e2e8f0; border-color: #94a3b8; }
+  .access-summary[data-state="all"] { border-color: #4ade80; background: #052e16; color: #dcfce7; }
+  .access-summary[data-state="selected"] { border-color: #60a5fa; background: #172554; color: #dbeafe; }
+  .access-summary[data-state="unknown"] { border-color: #facc15; background: #422006; color: #fef9c3; }
+}

package/extension/options.html

@@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>MagicVault browser setup</title><link rel="stylesheet" href="options.css"></head>
+<body><main><h1>MagicVault</h1><p>Keep credentials out of agent messages.</p>
+<p>This extension fills approved credential fields. It does not navigate, submit forms, or filter other browser tools’ observations.</p>
+<h2>1. Set up MagicVault</h2><p>Run <code>magicvault setup</code> once to install the native bridge and start MagicVault. This extension connects automatically. No extension ID needs copying for the bundled build. Source builds can use <code>magicvault extension install --host-executable /absolute/path/to/magicvault-native-host</code>.</p>
+<div class="identity-chip"><span class="identity-label">Extension ID</span><code id="extension-id" tabindex="0" aria-label="Installed extension ID"></code></div>
+<h2>2. Choose website access</h2>
+<div id="access-summary" class="access-summary" data-state="checking" role="status" aria-live="polite" aria-atomic="true">
+<span class="access-label">Current browser access</span>
+<strong id="access-mode">Checking browser permissions…</strong>
+<span>Browser permission only. Disabled sites, Chrome site restrictions and credential approvals still apply.</span>
+</div>
+<p>Allow all HTTPS websites once, or grant selected websites individually. Neither choice authorizes a credential: MagicVault still enforces exact page/frame origins, selected fields and native credential approval. The daemon asks each time unless you explicitly choose Always allow for an exact use. Existing installations keep their permissions; no broad access is granted automatically.</p>
+<div><button id="allow-all">Allow all HTTPS websites</button><button id="selected-only">Clear HTTPS access — use selected sites</button></div>
+<p id="permission-status" role="status"></p>
+<p>Clearing HTTPS access removes all HTTPS grants; then allow individual sites below. Local HTTP grants and disabled sites are retained. Broad access increases the extension’s reach if compromised. Chrome can still restrict site access.</p>
+<p>Browser grants: <span id="granted-sites"></span></p>
+<h3>Individual sites and local development</h3>
+<p>Enter an HTTPS origin (for example, <code>https://accounts.example.com</code>), or explicitly allow <code>http://localhost:PORT</code> / <code>http://127.0.0.1:PORT</code> for local development. All-HTTPS access never enables local HTTP. Browser permissions cover the exact host’s paths and ports.</p>
+<label for="origin">Site origin</label><input id="origin" type="url" placeholder="https://accounts.example.com" autocomplete="off">
+<div><button id="allow">Allow site</button><button id="remove">Remove site permission</button><button id="block">Disable site in MagicVault</button></div>
+<h3>Disabled sites</h3>
+<p>Disabled sites are excluded from MagicVault discovery and fills in either mode, including embedded frames. A disabled top-level site also blocks its frames. Entries cover the exact hostname and scheme on all paths and ports; subdomains require separate entries. Up to 256 entries are stored locally, without credentials or browser sync.</p>
+<p>This blocklist does not revoke Chrome’s underlying permission, protect against a compromised extension, or recall an already dispatched fill. Allowing a site does not remove its block.</p>
+<label for="blocked-sites">Disabled sites</label><select id="blocked-sites" size="5"></select>
+<div><button id="unblock">Re-enable selected site</button><button id="refresh-access">Refresh access settings</button></div>
+<p id="block-status" role="status"></p>
+<h2>3. Connection</h2><p>Approve the first native dialog for this profile. Approved profiles reconnect automatically, with a 30-second to 5-minute backoff when MagicVault is unavailable (Chrome may delay retries). Separate profiles keep separate connections. Denial, revoked authorization and conflicting copies of a profile stop retries until you choose Retry / resume. Every credential fill still needs approval.</p>
+<div class="identity-chip"><span class="identity-label">Browser profile ID</span><code id="profile-id" tabindex="0" aria-label="Browser profile ID"></code></div>
+<p>Match this profile ID in the native approval dialog. Pause stops this profile’s automatic connection and survives browser restarts; it does not revoke the remembered approval. To revoke it, use <code>magicvault disconnect-browser --browser-handle HANDLE</code>. New connections get fresh handles; never replay unfinished operations.</p>
+<button id="connect">Retry / resume</button><button id="disconnect">Pause connection</button><button id="refresh">Refresh status</button><p id="status" role="status" aria-live="polite"></p>
+<p>Never paste credentials into this page. Enroll values through MagicVault’s native hidden-input prompts. Websites receive filled values; this is not protection from privileged or unrestricted local software.</p>
+</main><script src="options.js"></script></body></html>

package/extension/options.js

@@ -0,0 +1,159 @@
+"use strict";
+const element = id => document.getElementById(id);
+element("extension-id").textContent = chrome.runtime.id;
+let changing = false;
+let refreshRevision = 0;
+let blockRevision = 0;
+let allHttpsEnabled = false;
+const accessButtons = ["allow-all", "selected-only", "allow", "remove", "block", "unblock"];
+
+function updateAccessButtons() {
+  for (const id of accessButtons) element(id).disabled = changing;
+  element("allow-all").disabled = changing || allHttpsEnabled;
+  element("allow-all").textContent = allHttpsEnabled ? "All HTTPS websites enabled" : "Allow all HTTPS websites";
+}
+
+function siteOrigin() {
+  const input = element("origin").value;
+  if (input.length > 256) throw new Error("invalid_origin");
+  const url = new URL(input);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.hostname.includes("*") ||
+      !(url.protocol === "https:" || (url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname)))) throw new Error("invalid_origin");
+  return url.origin;
+}
+
+async function refreshBrowserAccess() {
+  const revision = ++refreshRevision;
+  try {
+    const [all, grants] = await Promise.all([
+      chrome.permissions.contains({origins: ["https://*/*"]}),
+      chrome.permissions.getAll()
+    ]);
+    if (revision !== refreshRevision) return;
+    allHttpsEnabled = all;
+    const origins = grants.origins || [];
+    element("access-mode").textContent = all ? "All HTTPS websites enabled" : origins.length ? "Selected websites only" : "No websites allowed yet";
+    element("access-summary").dataset.state = all ? "all" : origins.length ? "selected" : "none";
+    element("granted-sites").textContent = origins.join(", ") || "No website permissions granted.";
+    updateAccessButtons();
+  } catch (_) {
+    if (revision !== refreshRevision) return;
+    allHttpsEnabled = false;
+    element("access-mode").textContent = "Browser access could not be verified";
+    element("access-summary").dataset.state = "unknown";
+    element("granted-sites").textContent = "Browser permissions unavailable. Refresh to check again.";
+    updateAccessButtons();
+  }
+}
+
+async function refreshBlockedSites() {
+  const revision = ++blockRevision;
+  try {
+    const policy = await chrome.runtime.sendMessage({action: "site-policy"});
+    if (revision !== blockRevision) return;
+    element("blocked-sites").replaceChildren();
+    if (!policy?.ok) throw new Error("policy_unavailable");
+    for (const site of policy.blockedSites) {
+      const option = document.createElement("option");
+      option.value = site;
+      option.textContent = site;
+      element("blocked-sites").append(option);
+    }
+    element("block-status").textContent = policy.blockedSites.length ? `${policy.blockedSites.length} site(s) disabled in MagicVault.` : "No sites disabled in MagicVault.";
+  } catch (_) {
+    if (revision === blockRevision) {
+      element("blocked-sites").replaceChildren();
+      element("block-status").textContent = "Blocklist unavailable. MagicVault refuses fills if its site policy cannot be read.";
+    }
+  }
+}
+
+async function refreshAccess() {
+  // Chrome's grant is independent of native connection and blocklist availability.
+  // A slow/failed worker must not hide an already confirmed browser permission.
+  await Promise.all([refreshBrowserAccess(), refreshBlockedSites()]);
+}
+
+async function changeAccess(action) {
+  if (changing) return;
+  changing = true;
+  updateAccessButtons();
+  const output = element("permission-status");
+  try {
+    output.textContent = "Applying change. If Chrome asks for permission, approve or dismiss its prompt.";
+    // Call the action before yielding: permission requests require a user gesture.
+    output.textContent = await action();
+  } catch (_) {
+    output.textContent = "Change failed. Use an exact HTTPS origin or supported local HTTP origin; check permissions and refresh before retrying.";
+  } finally {
+    await refreshAccess();
+    changing = false;
+    updateAccessButtons();
+  }
+}
+
+element("allow-all").addEventListener("click", () => changeAccess(async () => {
+  const allowed = await chrome.permissions.request({origins: ["https://*/*"]});
+  return allowed ? "All HTTPS access granted. Disabled sites and credential approvals still apply. Local HTTP was not enabled." : "All HTTPS access was not granted. Existing settings retained.";
+}));
+element("selected-only").addEventListener("click", () => changeAccess(async () => {
+  // Reset HTTPS grants explicitly; do not claim to preserve narrower grants when
+  // Chrome removes an overlapping wildcard. Local HTTP grants are independent.
+  const origins = (await chrome.permissions.getAll()).origins?.filter(origin => origin.startsWith("https://")) || [];
+  if (origins.length && !await chrome.permissions.remove({origins})) throw new Error("permission_denied");
+  if (await chrome.permissions.contains({origins: ["https://*/*"]})) throw new Error("permission_denied");
+  return "HTTPS grants cleared. Allow individual sites below. Local HTTP grants and disabled sites are unchanged.";
+}));
+element("allow").addEventListener("click", () => changeAccess(async () => {
+  const url = new URL(siteOrigin());
+  const allowed = await chrome.permissions.request({origins: [`${url.protocol}//${url.hostname}/*`]});
+  return allowed ? "Site permission granted. A disabled site stays blocked until re-enabled; exact credential origins still need MagicVault approval." : "Site permission was not granted.";
+}));
+element("remove").addEventListener("click", () => changeAccess(async () => {
+  const url = new URL(siteOrigin());
+  if (url.protocol === "https:" && await chrome.permissions.contains({origins: ["https://*/*"]})) {
+    return "All HTTPS access is enabled. Use Disable site, or clear HTTPS access and allow only selected sites.";
+  }
+  const origins = [`${url.protocol}//${url.hostname}/*`];
+  if (!await chrome.permissions.remove({origins}) || await chrome.permissions.contains({origins})) throw new Error("permission_denied");
+  return "Site permission removed. Other grants and disabled sites are unchanged.";
+}));
+async function setBlock(site, blocked) {
+  const response = await chrome.runtime.sendMessage({action: "site-block", site, blocked});
+  if (!response?.ok) throw new Error("policy_unavailable");
+  return blocked ? "Site disabled for MagicVault discovery and fills. Chrome's underlying permission is unchanged; already dispatched fills cannot be recalled." : "Site re-enabled in MagicVault. Browser permission and credential approval are still required.";
+}
+element("block").addEventListener("click", () => changeAccess(() => setBlock(siteOrigin(), true)));
+element("unblock").addEventListener("click", () => changeAccess(() => setBlock(element("blocked-sites").value, false)));
+element("refresh-access").addEventListener("click", refreshAccess);
+chrome.permissions.onAdded.addListener(refreshAccess);
+chrome.permissions.onRemoved.addListener(refreshAccess);
+chrome.storage.onChanged.addListener((changes, area) => {
+  if (area === "local" && Object.hasOwn(changes, "sitePolicy")) void refreshAccess();
+  if (area === "local" && Object.hasOwn(changes, "connection")) void control("status");
+});
+window.addEventListener("focus", () => { void refreshAccess(); });
+document.addEventListener("visibilitychange", () => {
+  if (document.visibilityState === "visible") void refreshAccess();
+});
+async function control(action) {
+  const output = document.getElementById("status");
+  try {
+    const state = await chrome.runtime.sendMessage({action});
+    element("profile-id").textContent = state.profile_id || "Not available";
+    const reasons = {paused: "Paused by you.", denied: "Browser authorization was denied or revoked.",
+      unauthorized: "Pairing is missing or revoked. Check MagicVault setup.", conflict: "Another connection is using this profile identity. Close the copied profile before retrying.",
+      capacity: "MagicVault's browser or pairing limit was reached.", unsupported_version: "Update MagicVault and reload the matching extension.",
+      storage_unavailable: "Local connection settings could not be saved or read. Reload after fixing storage; no automatic retry.",
+      expired: "The connection approval timed out.", cancelled: "Connection approval was cancelled."};
+    output.textContent = state.connected ? `Connected. Browser handle: ${state.browser_handle}` : state.connecting ? "Connecting to MagicVault. Approve the native dialog if this is the first connection for this profile." :
+      state.paused ? `${reasons[state.reason] || "Connection stopped for safety. Check MagicVault setup."} Choose Retry / resume when ready.` :
+      state.retry_at ? `MagicVault is unavailable or busy. Automatic retry after ${new Date(state.retry_at).toLocaleTimeString()} (Chrome may delay it). Run magicvault setup if the native bridge is not installed.` : "Waiting for automatic connection.";
+    element("connect").disabled = state.connected || state.connecting;
+  } catch (_) { output.textContent = "Connection unavailable. Check the documented setup."; }
+}
+document.getElementById("connect").addEventListener("click", () => control("connect"));
+document.getElementById("disconnect").addEventListener("click", () => control("disconnect"));
+document.getElementById("refresh").addEventListener("click", () => control("status"));
+void refreshAccess();
+void control("status");

package/extension/worker.js

@@ -0,0 +1,463 @@
+/* global magicvaultFill */
+"use strict";
+// Packaging copies the fixed function from magicvault-effect/src/fill.js.
+// No remote code, page message receiver, generic evaluate, or enrolled-secret storage.
+// Trusted local storage holds site settings and a profile-pairing capability.
+importScripts("fill.js");
+
+const HOST = "ai.magicbeans.magicvault";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Chrome document IDs are opaque tokens, commonly 32 uppercase hex digits,
+// not our daemon's hyphenated UUID handles. Preserve the exact browser value.
+const DOCUMENT_ID = /^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+const validDocumentId = value => typeof value === "string" &&
+  (value.length === 32 || value.length === 36) && DOCUMENT_ID.test(value);
+let channel = null;
+let generation = 0;
+let browserHandle = null;
+let busy = false;
+let accessRevision = 0;
+let policyWritePending = false;
+const POLICY_KEY = "sitePolicy";
+// A failed storage restriction must deny operations, not crash worker registration.
+const storageReady = chrome.storage.local.setAccessLevel({accessLevel: "TRUSTED_CONTEXTS"})
+  .then(() => true, () => false);
+chrome.storage.onChanged.addListener((changes, area) => {
+  if (area === "local" && Object.hasOwn(changes, POLICY_KEY)) accessRevision++;
+});
+chrome.permissions.onAdded.addListener(() => { accessRevision++; });
+chrome.permissions.onRemoved.addListener(() => { accessRevision++; });
+
+function originOf(value) {
+  const url = new URL(value);
+  if (url.username || url.password || !(url.protocol === "https:" ||
+      (url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname)))) throw new Error("unsupported_target");
+  if (url.origin.length > 256) throw new Error("unsupported_target");
+  return url.origin;
+}
+
+function permissionPattern(origin) {
+  const url = new URL(origin);
+  return `${url.protocol}//${url.hostname}/*`;
+}
+
+function siteKey(value) {
+  if (typeof value !== "string" || value.length > 256) throw new Error("invalid_site");
+  const url = new URL(value);
+  originOf(value);
+  if (url.pathname !== "/" || url.search || url.hash || url.hostname.includes("*")) throw new Error("invalid_site");
+  // Block the exact hostname on every port, including its DNS trailing-dot alias.
+  return `${url.protocol}//${url.hostname.replace(/\.$/, "")}`;
+}
+
+async function readSitePolicy() {
+  if (!await storageReady) throw new Error("policy_unavailable");
+  const stored = (await chrome.storage.local.get(POLICY_KEY))[POLICY_KEY];
+  // Existing installations retain their Chrome grants and start with no blocks.
+  if (stored === undefined) return {version: 1, blockedSites: []};
+  if (!stored || stored.version !== 1 || !Array.isArray(stored.blockedSites) ||
+      stored.blockedSites.length > 256 ||
+      stored.blockedSites.some(site => siteKey(site) !== site) ||
+      new Set(stored.blockedSites).size !== stored.blockedSites.length) throw new Error("policy_unavailable");
+  return stored;
+}
+
+async function changeSiteBlock(site, blocked) {
+  // One writer across setup tabs; do not lose concurrent read/modify/write updates.
+  if (policyWritePending || typeof blocked !== "boolean") throw new Error("policy_unavailable");
+  const key = siteKey(site);
+  policyWritePending = true;
+  accessRevision++;
+  try {
+    const policy = await readSitePolicy();
+    const sites = new Set(policy.blockedSites);
+    if (blocked) sites.add(key); else sites.delete(key);
+    if (sites.size > 256) throw new Error("policy_unavailable");
+    const updated = {version: 1, blockedSites: [...sites].sort()};
+    await chrome.storage.local.set({[POLICY_KEY]: updated});
+    return updated;
+  } finally {
+    policyWritePending = false;
+    accessRevision++;
+  }
+}
+
+function accessUnchanged(revision) {
+  return !policyWritePending && accessRevision === revision;
+}
+
+async function permitted(origin, policy) {
+  return !policy.blockedSites.includes(siteKey(origin)) &&
+    await chrome.permissions.contains({origins: [permissionPattern(origin)]});
+}
+
+function active(port, epoch) {
+  if (channel !== port || generation !== epoch || !browserHandle) throw new Error("stale_session");
+}
+
+const CONNECTION_KEY = "connection";
+const RETRY_ALARM = "magicvault-reconnect";
+const WATCHDOG_ALARM = "magicvault-handshake";
+const NATIVE_VERSION = 2;
+const TRANSIENT = ["busy", "transport_unavailable", "transport_uncertain"];
+const REASONS = ["paused", "denied", "unauthorized", "conflict", "capacity", "unsupported_version",
+  "invalid_request", "unavailable", "expired", "cancelled", "persistence_uncertain", "storage_unavailable",
+  ...TRANSIENT];
+let connection = null;
+let pausedNow = false;
+let connectionError = null;
+let connectionWork = Promise.resolve();
+
+function closeChannel() {
+  const old = channel;
+  channel = null;
+  browserHandle = null;
+  generation++;
+  busy = false;
+  if (old) { try { old.disconnect(); } catch (_) {} }
+}
+
+function connectionStatus() {
+  return {connected: Boolean(browserHandle), connecting: Boolean(channel) && !browserHandle,
+    browser_handle: browserHandle, profile_id: connection?.profile_id || null,
+    paused: pausedNow || connection?.mode === "paused", reason: connectionError || connection?.reason || null,
+    retry_at: connection?.mode === "enabled" ? connection.retryAt : 0};
+}
+
+function transition(work) {
+  // A single writer covers startup, alarms, native events and multiple setup tabs.
+  connectionWork = connectionWork.then(work).catch(async () => {
+    pausedNow = true;
+    connectionError = "storage_unavailable";
+    closeChannel();
+    await Promise.allSettled([chrome.alarms.clear(RETRY_ALARM), chrome.alarms.clear(WATCHDOG_ALARM)]);
+  });
+  return connectionWork;
+}
+
+async function saveConnection() {
+  if (!await storageReady || !connection) throw new Error("storage_unavailable");
+  await chrome.storage.local.set({[CONNECTION_KEY]: connection});
+}
+
+async function stopConnection(reason) {
+  closeChannel();
+  connection.mode = "paused";
+  connection.reason = reason;
+  connection.retryAt = 0;
+  await saveConnection();
+  await chrome.alarms.clear(RETRY_ALARM);
+  await chrome.alarms.clear(WATCHDOG_ALARM);
+}
+
+async function failedConnection(code) {
+  if (pausedNow || connection?.mode === "paused") return;
+  closeChannel();
+  await chrome.alarms.clear(WATCHDOG_ALARM);
+  if (!TRANSIENT.includes(code)) return stopConnection(REASONS.includes(code) ? code : "invalid_request");
+  connection.failures = Math.min(connection.failures + 1, 5);
+  // MV3 alarms survive worker suspension; Chrome 120's minimum is 30 seconds.
+  // Keep the deadline durable so unrelated worker wakeups cannot bypass backoff.
+  const delay = Math.min(30 * 2 ** (connection.failures - 1), 300);
+  connection.retryAt = Date.now() + (delay + Math.floor(Math.random() * 6)) * 1000;
+  connection.reason = code;
+  await saveConnection();
+  if (!pausedNow && connection.mode === "enabled") {
+    await chrome.alarms.create(RETRY_ALARM, {when: connection.retryAt});
+  }
+}
+
+function failChannel(code, port, epoch) {
+  if (channel !== port || generation !== epoch) return;
+  closeChannel();
+  const closedEpoch = generation;
+  void transition(async () => {
+    if (generation === closedEpoch) await failedConnection(code);
+  });
+}
+
+async function connect(manual = false) {
+  if (channel || pausedNow || connection?.mode !== "enabled") return;
+  if (!manual && connection.retryAt > Date.now()) {
+    await chrome.alarms.create(RETRY_ALARM, {when: connection.retryAt});
+    return;
+  }
+  const epoch = ++generation;
+  let port;
+  try { port = chrome.runtime.connectNative(HOST); }
+  catch (_) { return failedConnection("transport_unavailable"); }
+  channel = port;
+  port.onDisconnect.addListener(() => {
+    void chrome.runtime.lastError; // Do not reflect native/browser diagnostics.
+    if (channel !== port || generation !== epoch) return;
+    failChannel("transport_unavailable", port, epoch);
+  });
+  port.onMessage.addListener(message => {
+    if (channel !== port || epoch !== generation) return;
+    if (message?.kind === "error") {
+      const code = message.version === NATIVE_VERSION ? message.code : "unsupported_version";
+      failChannel(code, port, epoch);
+      return;
+    }
+    if (!browserHandle) {
+      if (message?.kind !== "ready" || message.version !== NATIVE_VERSION || !UUID.test(message.browser_handle)) {
+        failChannel("unsupported_version", port, epoch);
+        return;
+      }
+      browserHandle = message.browser_handle;
+      void transition(async () => {
+        if (channel !== port || generation !== epoch) return;
+        connection.failures = 0; connection.retryAt = 0; connection.reason = null;
+        await saveConnection();
+        await chrome.alarms.clear(RETRY_ALARM);
+        await chrome.alarms.clear(WATCHDOG_ALARM);
+      });
+      return;
+    }
+    if (busy || !UUID.test(message?.request_id) || !message.request ||
+        !["targets", "filtered_targets", "fill"].includes(message.request.method)) {
+      failChannel("invalid_request", port, epoch); return;
+    }
+    busy = true;
+    handle(message.request, port, epoch).then(result => {
+      if (channel === port && generation === epoch) port.postMessage({request_id: message.request_id, result});
+    }).catch(() => {
+      // Reconnect transport, never replay an operation with uncertain effects.
+      if (channel === port && generation === epoch) {
+        failChannel("transport_uncertain", port, epoch);
+      }
+    }).finally(() => { if (generation === epoch) busy = false; });
+  });
+  try {
+    // Profile capability never goes to the options page, agent or website.
+    port.postMessage({version: NATIVE_VERSION, profile_id: connection.profile_id,
+      capability: connection.capability, manual});
+    await chrome.alarms.create(WATCHDOG_ALARM, {delayInMinutes: 4});
+  } catch (_) {
+    if (channel === port && generation === epoch) await failedConnection("transport_unavailable");
+  }
+}
+
+async function initializeConnection() {
+  if (!await storageReady) throw new Error("storage_unavailable");
+  const stored = (await chrome.storage.local.get(CONNECTION_KEY))[CONNECTION_KEY];
+  if (stored === undefined) {
+    connection = {version: 1, profile_id: crypto.randomUUID(),
+      capability: Array.from(crypto.getRandomValues(new Uint8Array(32)), x => x.toString(16).padStart(2, "0")).join(""),
+      mode: "enabled", failures: 0, retryAt: 0, reason: null};
+    await saveConnection();
+  } else {
+    if (!stored || stored.version !== 1 || !UUID.test(stored.profile_id) ||
+        !/^[0-9a-f]{64}$/.test(stored.capability) || !["enabled", "paused"].includes(stored.mode) ||
+        !Number.isInteger(stored.failures) || stored.failures < 0 || stored.failures > 5 ||
+        !Number.isSafeInteger(stored.retryAt) || stored.retryAt < 0 ||
+        (stored.reason !== null && !REASONS.includes(stored.reason))) throw new Error("storage_unavailable");
+    connection = stored;
+    // A clock adjustment must not suspend recovery indefinitely.
+    connection.retryAt = Math.min(connection.retryAt, Date.now() + 305000);
+  }
+  await chrome.alarms.clear(WATCHDOG_ALARM);
+  if (connection.mode === "paused" || pausedNow) {
+    await chrome.alarms.clear(RETRY_ALARM);
+    return;
+  }
+  await connect();
+}
+
+async function targets(port, epoch, filter) {
+  if (!filter || typeof filter !== "object" || Array.isArray(filter) ||
+      Object.keys(filter).some(key => !["top_origin", "tab_id"].includes(key)) ||
+      (Object.hasOwn(filter, "top_origin") && typeof filter.top_origin !== "string") ||
+      (Object.hasOwn(filter, "tab_id") && (typeof filter.tab_id !== "string" ||
+        !/^(?:0|[1-9][0-9]{0,9})$/.test(filter.tab_id)))) return {kind: "error", data: "invalid_request"};
+  if (Object.hasOwn(filter, "top_origin")) {
+    try { siteKey(filter.top_origin); if (originOf(filter.top_origin) !== filter.top_origin) throw new Error(); }
+    catch (_) { return {kind: "error", data: "invalid_request"}; }
+  }
+  const revision = accessRevision;
+  let policy;
+  let origins;
+  try {
+    policy = await readSitePolicy();
+    ({origins = []} = await chrome.permissions.getAll());
+  }
+  catch (_) { return {kind: "error", data: "permission_denied"}; }
+  active(port, epoch);
+  if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+  if (!origins.length) return {kind: "targets", data: []};
+  // A caller's narrowing is never a grant. Verify it against current Chrome
+  // authority before querying even a requested site's tab metadata.
+  if (filter.top_origin) {
+    const allowed = await permitted(filter.top_origin, policy);
+    active(port, epoch);
+    if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+    if (!allowed) return {kind: "targets", data: []};
+    origins = [permissionPattern(filter.top_origin)];
+  }
+  // Host grants allow URL queries without the broad "tabs" permission. Chrome
+  // may omit a URL (e.g. after revocation); never fall back to inspecting it.
+  // Discarded tabs have no loaded document. Discovery must not wake them.
+  const tabs = await chrome.tabs.query({url: origins, discarded: false});
+  active(port, epoch);
+  // Cache only for this revision/operation, including repeated cross-origin
+  // frames. Fills still perform their own fresh, uncached permission checks.
+  const permissions = new Map();
+  const permittedHere = async origin => {
+    if (policy.blockedSites.includes(siteKey(origin))) return false;
+    const pattern = permissionPattern(origin);
+    if (!permissions.has(pattern)) {
+      permissions.set(pattern, await chrome.permissions.contains({origins: [pattern]}));
+    }
+    return permissions.get(pattern);
+  };
+  const candidates = [];
+  for (const tab of tabs) {
+    active(port, epoch);
+    if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+    if (tab.discarded || !Number.isInteger(tab.id) || tab.id < 0 ||
+        typeof tab.url !== "string") continue;
+    if (filter.tab_id && String(tab.id) !== filter.tab_id) continue;
+    let origin;
+    try { origin = originOf(tab.url); } catch (_) { continue; }
+    // Chrome match patterns ignore ports; the actual origin must still match.
+    if (filter.top_origin && origin !== filter.top_origin) continue;
+    if (!await permittedHere(origin)) continue;
+    active(port, epoch);
+    if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+    candidates.push(tab.id);
+    // Bound expensive frame inspection, not the profile's unrelated tab count.
+    // Never silently truncate a discovery response to fit the wire budget.
+    if (candidates.length > 128) return {kind: "error", data: "capacity"};
+  }
+  const result = [];
+  for (const tabId of candidates) {
+    active(port, epoch);
+    if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+    let frames;
+    try { frames = await chrome.webNavigation.getAllFrames({tabId}); }
+    catch (_) { continue; }
+    active(port, epoch);
+    if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+    if (!frames || frames.length > 128) continue;
+    const top = frames.find(frame => frame.frameId === 0 && frame.documentLifecycle === "active");
+    if (!top || top.errorOccurred || !validDocumentId(top.documentId)) continue;
+    let topOrigin;
+    try { topOrigin = originOf(top.url); } catch (_) { continue; }
+    if (filter.top_origin && topOrigin !== filter.top_origin) continue;
+    if (!await permittedHere(topOrigin)) continue;
+    for (const frame of frames) {
+      active(port, epoch);
+      if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+      if (frame.errorOccurred || frame.documentLifecycle !== "active" || !validDocumentId(frame.documentId)) continue;
+      let origin;
+      try { origin = originOf(frame.url); } catch (_) { continue; }
+      if (!await permittedHere(origin)) continue;
+      result.push({tab: String(tabId), frame: String(frame.frameId), document: frame.documentId,
+        top_document: top.documentId, origin, top_origin: topOrigin, is_main_frame: frame.frameId === 0});
+      if (result.length > 128) return {kind: "error", data: "capacity"};
+    }
+  }
+  active(port, epoch);
+  if (!accessUnchanged(revision)) return {kind: "error", data: "permission_denied"};
+  return {kind: "targets", data: result};
+}
+
+async function fill(params, port, epoch) {
+  const fields = params?.fields;
+  const target = params?.target;
+  if (!Array.isArray(fields) || fields.length === 0 || fields.length > 8 || !target) throw new Error("invalid_request");
+  const failed = error => ({kind: "filled", data: {fields: fields.map(() => "not_filled"), error}});
+  const uncertain = () => ({kind: "filled", data: {fields: fields.map(() => "uncertain"), error: "transport_uncertain"}});
+  try {
+    if (!/^[0-9]{1,10}$/.test(target.tab) || !/^[0-9]{1,10}$/.test(target.frame) ||
+        !validDocumentId(target.document) || !validDocumentId(target.top_document) ||
+        originOf(target.origin) !== target.origin || originOf(target.top_origin) !== target.top_origin ||
+        fields.some(field => typeof field.css !== "string" || field.css.length > 512 ||
+          typeof field.value !== "string" || field.value.length === 0 || field.value.length > 4096)) return failed("invalid_request");
+    const revision = accessRevision;
+    let policy;
+    try { policy = await readSitePolicy(); } catch (_) { return failed("permission_denied"); }
+    if (!accessUnchanged(revision) || !await permitted(target.origin, policy) ||
+        !await permitted(target.top_origin, policy)) return failed("permission_denied");
+    active(port, epoch);
+    const tabId = Number(target.tab);
+    const frameId = Number(target.frame);
+    const frame = await chrome.webNavigation.getFrame({tabId, frameId, documentId: target.document});
+    const top = await chrome.webNavigation.getFrame({tabId, frameId: 0, documentId: target.top_document});
+    active(port, epoch);
+    if (!frame || !top || frame.errorOccurred || top.errorOccurred ||
+        frame.documentLifecycle !== "active" || top.documentLifecycle !== "active" ||
+        frame.documentId !== target.document || top.documentId !== target.top_document ||
+        originOf(frame.url) !== target.origin || originOf(top.url) !== target.top_origin ||
+        target.is_main_frame !== (frameId === 0)) return failed("stale_target");
+    // Re-read after asynchronous document checks. Previously discovered handles
+    // never bypass a new block or Chrome permission revocation.
+    try { policy = await readSitePolicy(); } catch (_) { return failed("permission_denied"); }
+    if (!await permitted(target.origin, policy) || !await permitted(target.top_origin, policy) ||
+        !accessUnchanged(revision)) return failed("permission_denied");
+    active(port, epoch);
+    // documentIds, not frameIds: navigation must fail rather than selecting a
+    // replacement document between preflight and execution. Isolated world
+    // avoids page-overridden JS primitives; the resulting DOM is still shared.
+    let results;
+    try {
+      results = await chrome.scripting.executeScript({target: {tabId, documentIds: [target.document]},
+        world: "ISOLATED", func: magicvaultFill, args: [target.origin, fields]});
+    } catch (_) { return uncertain(); }
+    active(port, epoch);
+    if (results.length !== 1 || results[0].documentId !== target.document || results[0].frameId !== frameId) return uncertain();
+    const outcome = results[0].result;
+    const errors = [null, "invalid_request", "stale_target", "unsupported_target", "ambiguous_target", "unavailable"];
+    if (!outcome || !Array.isArray(outcome.fields) || outcome.fields.length !== fields.length ||
+        outcome.fields.some(state => !["filled", "not_filled", "uncertain"].includes(state)) || !errors.includes(outcome.error)) return uncertain();
+    return {kind: "filled", data: {fields: outcome.fields, error: outcome.error}};
+  } catch (_) {
+    return failed("stale_target");
+  } finally {
+    for (const field of fields) if (field && typeof field === "object") field.value = "";
+  }
+}
+
+async function handle(request, port, epoch) {
+  active(port, epoch);
+  if (request.method === "targets") return targets(port, epoch, {});
+  if (request.method === "filtered_targets") return targets(port, epoch, request.params);
+  return fill(request.params, port, epoch);
+}
+
+chrome.runtime.onMessage.addListener((message, sender, reply) => {
+  // Only our own extension setup page; no content-script or website command
+  // path. The setup page never handles credential material.
+  if (sender.id !== chrome.runtime.id || sender.url !== chrome.runtime.getURL("options.html")) return false;
+  if (message?.action === "site-policy" || message?.action === "site-block") {
+    const operation = message.action === "site-policy" ? readSitePolicy() : changeSiteBlock(message.site, message.blocked);
+    operation.then(policy => reply({ok: true, blockedSites: policy.blockedSites}),
+      () => reply({ok: false}));
+    return true;
+  }
+  if (message?.action === "disconnect") {
+    pausedNow = true;
+    closeChannel(); // Invalidate in-flight preflight before any asynchronous write.
+    transition(() => stopConnection("paused")).then(() => reply(connectionStatus()));
+  } else if (message?.action === "connect") {
+    pausedNow = false;
+    transition(async () => {
+      if (!connection || connectionError) throw new Error("storage_unavailable");
+      connection.mode = "enabled"; connection.retryAt = 0; connection.failures = 0; connection.reason = null;
+      await saveConnection(); await connect(true);
+    }).then(() => reply(connectionStatus()));
+  } else if (message?.action === "status") {
+    connectionWork.then(() => reply(connectionStatus()));
+  } else return false;
+  return true;
+});
+chrome.action.onClicked.addListener(() => chrome.runtime.openOptionsPage());
+chrome.runtime.onInstalled.addListener(() => chrome.runtime.openOptionsPage());
+chrome.runtime.onStartup.addListener(() => { void transition(() => connect()); });
+chrome.alarms.onAlarm.addListener(alarm => {
+  if (alarm.name === RETRY_ALARM) void transition(() => connect());
+  else if (alarm.name === WATCHDOG_ALARM) void transition(async () => {
+    if (channel && !browserHandle) await failedConnection("expired");
+  });
+});
+void transition(initializeConnection);

package/package.json

@@ -0,0 +1,44 @@
+{
+  "version": "0.9.0",
+  "license": "MIT OR Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MagicBeansAI/MagicVault.git"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "homepage": "https://github.com/MagicBeansAI/MagicVault#readme",
+  "bugs": {
+    "url": "https://github.com/MagicBeansAI/MagicVault/issues"
+  },
+  "keywords": [
+    "mcp",
+    "credentials",
+    "vault",
+    "agents",
+    "typescript",
+    "alpha"
+  ],
+  "name": "@magicbeansai/magicvault-win32-x64",
+  "description": "Prebuilt MagicVault executables and browser extension for win32-x64",
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "files": [
+    "bin",
+    "extension",
+    "examples",
+    "bundle.json",
+    "LICENSE-MIT",
+    "LICENSE-APACHE"
+  ]
+}