browsentic 0.4.9 → 0.4.10

package/dist/cli.js

@@ -31308,14 +31308,24 @@ var DEFAULT_RULES = [
     // its work: the panel puts the source behind a Review button, because "allow this
     // action?" is not a question anyone can answer about code they have not read. It
     // confirms rather than denies because a reviewed function is how twenty repetitions
-    // stop being twenty round trips — and `unattended: deny` keeps an external MCP
-    // client, which has nobody to show the code to, from installing any at all.
+    // stop being twenty round trips.
     id: "code-injection",
     when: "injectsCode",
     effect: "confirm",
     title: "Runs code it wrote in the page",
     reason: "That installs JavaScript the agent wrote into the page, with your logged-in session."
   },
+  {
+    // `code-injection` confirms, and a confirm is what `unattended: allow` waives, so on
+    // its own it left installation one config line away from an MCP client. Denying is
+    // not a duplicate of that rule: it is the half that cannot be configured off, which
+    // is what the equivalent rule below has always been for calls.
+    id: "external-code-injection",
+    when: "injectsCodeOutsideThePanel",
+    effect: "deny",
+    title: "Installs code from outside the panel",
+    reason: "Installing page code needs a person to read it first, and an MCP client has nobody to show it to. Ask from the Browsentic side panel instead."
+  },
   {
     id: "external-code-execution",
     when: "runsCodeOutsideThePanel",
@@ -33862,7 +33872,7 @@ function text2(uri, mimeType, body) {
 // package.json
 var package_default = {
   name: "browsentic",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Hand your real, logged-in browser to the AI agent you already run. Installs the browser extension, runs the local daemon, and speaks MCP.",
   type: "module",
   license: "MIT",

package/dist/daemon-main.js

@@ -22633,11 +22633,16 @@ var CONDITIONS = {
    */
   injectsCode: (request) => request.action === INJECT_ACTION,
   /**
-   * The one place a caller is named in a condition rather than left to `unattended`.
+   * The two places a caller is named in a condition rather than left to `unattended`.
    * A toolkit is approved by a person reading it in the side panel, for the conversation
    * they were having; an MCP client was never in that room, and the switch the user
    * turned off is not one it can see.
+   *
+   * Both halves have to say so themselves. `unattended` only answers a `confirm`, so a
+   * rule that merely confirms is one config line away from being waived, and writing new
+   * code is the more powerful half of the pair, not the lesser one.
    */
+  injectsCodeOutsideThePanel: (request) => request.action === INJECT_ACTION && request.caller === "external",
   runsCodeOutsideThePanel: (request) => request.action === RUN_CODE_ACTION && request.caller === "external",
   /**
    * Turns a sealed placeholder back into the credential it stands for. The release
@@ -22726,14 +22731,24 @@ var DEFAULT_RULES = [
     // its work: the panel puts the source behind a Review button, because "allow this
     // action?" is not a question anyone can answer about code they have not read. It
     // confirms rather than denies because a reviewed function is how twenty repetitions
-    // stop being twenty round trips — and `unattended: deny` keeps an external MCP
-    // client, which has nobody to show the code to, from installing any at all.
+    // stop being twenty round trips.
     id: "code-injection",
     when: "injectsCode",
     effect: "confirm",
     title: "Runs code it wrote in the page",
     reason: "That installs JavaScript the agent wrote into the page, with your logged-in session."
   },
+  {
+    // `code-injection` confirms, and a confirm is what `unattended: allow` waives, so on
+    // its own it left installation one config line away from an MCP client. Denying is
+    // not a duplicate of that rule: it is the half that cannot be configured off, which
+    // is what the equivalent rule below has always been for calls.
+    id: "external-code-injection",
+    when: "injectsCodeOutsideThePanel",
+    effect: "deny",
+    title: "Installs code from outside the panel",
+    reason: "Installing page code needs a person to read it first, and an MCP client has nobody to show it to. Ask from the Browsentic side panel instead."
+  },
   {
     id: "external-code-execution",
     when: "runsCodeOutsideThePanel",
@@ -27093,7 +27108,7 @@ X-Browsentic-Reason: ${reason}\r
 // package.json
 var package_default = {
   name: "browsentic",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Hand your real, logged-in browser to the AI agent you already run. Installs the browser extension, runs the local daemon, and speaks MCP.",
   type: "module",
   license: "MIT",

package/extension/chrome-mv3/manifest.json

@@ -1 +1 @@
-{"manifest_version":3,"name":"Browsentic","description":"Reimagine browsing as agentic — driven by the AI agent you already run, in your own logged-in browser.","version":"0.4.9","icons":{"16":"icon/16.png","32":"icon/32.png","48":"icon/48.png","96":"icon/96.png","128":"icon/128.png"},"permissions":["storage","unlimitedStorage","activeTab","sidePanel","contextMenus","alarms","scripting","notifications","debugger","downloads"],"host_permissions":["<all_urls>"],"background":{"service_worker":"background.js"},"action":{"default_title":"Browsentic","default_popup":"popup.html"},"side_panel":{"default_path":"sidepanel.html"},"content_scripts":[{"matches":["*://*/*"],"js":["content-scripts/content.js"]}]}
+{"manifest_version":3,"name":"Browsentic","description":"Reimagine browsing as agentic — driven by the AI agent you already run, in your own logged-in browser.","version":"0.4.10","icons":{"16":"icon/16.png","32":"icon/32.png","48":"icon/48.png","96":"icon/96.png","128":"icon/128.png"},"permissions":["storage","unlimitedStorage","activeTab","sidePanel","contextMenus","alarms","scripting","notifications","debugger","downloads"],"host_permissions":["<all_urls>"],"background":{"service_worker":"background.js"},"action":{"default_title":"Browsentic","default_popup":"popup.html"},"side_panel":{"default_path":"sidepanel.html"},"content_scripts":[{"matches":["*://*/*"],"js":["content-scripts/content.js"]}]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browsentic",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Hand your real, logged-in browser to the AI agent you already run. Installs the browser extension, runs the local daemon, and speaks MCP.",
   "type": "module",
   "license": "MIT",