browserzap 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.7.0 — public launch
+
+BrowserZap is public: free, and installed from the Chrome Web Store.
+
+- **The extension comes from the Chrome Web Store:**
+  <https://chromewebstore.google.com/detail/bbnmhaonicbmljhbahimpgfafbjoijpe>. Chrome keeps it updated. There is no
+  folder to load and no Developer mode.
+- **The npm package no longer includes the extension.** `npm install -g browserzap` brings the bridge, the native
+  messaging helper and the MCP server — not `extension/`. `browserzap setup` prints the store link when the extension
+  is missing, and `--extension` (a developer option) now says so instead of installing nothing.
+- **The helper accepts only the store extension by default.** `browserzap setup --dev` adds a developer's unpacked
+  build to the allowed ids and remembers the choice; a plain `setup` goes back to store-only and says so.
+- **`browserzap doctor` works on an npm install** with no bundled extension: it names the store id and passes.
+- **The bridge knows which extension it is talking to.** `hello` carries the extension's version, `browser_status`
+  shows it, and a store build older than the bridge gets a notice — never a refused connection. Chrome updates the
+  extension on its own; to update now, open `chrome://extensions` and press **Update**.
+- **A new side panel, built to be understood on first sight** (Preact, still compiled locally with Tailwind):
+  - **Chat** shows what the agent does in this tab as a conversation, and a first-visit guide in three steps with
+    prompts to copy. **Workflows** holds saved tasks. The Comment tab is gone: **Point at page** at the bottom of the
+    panel does the same.
+  - **Notes reach the agent sooner.** Every tool result now tells the agent that notes are waiting until it calls
+    `feedback_get` (it used to be `browser_status` only).
+  - **Take over / Hand back** replaces the Collab/AI/User switch. Approvals and "Your turn" hand-offs sit at the
+    bottom, always in reach; a decision waiting in another tab says so with a **Show** button.
+  - A half-typed hand-off note is no longer wiped while the agent works, and the conversation stops jumping to the
+    bottom while you read further up.
+- **Give your agent the tab you are on.** **Let the agent use this tab** in that tab's panel: the agent's next request
+  works there instead of opening a new tab, and an agent already working sees it in `browser_list_tabs` (role
+  `shared-available`) and can `browser_switch_tab` to it. An agent never takes a tab nobody shared. A shared tab stays
+  yours: when the session ends it is kept, not closed.
+- **Chrome's "BrowserZap started debugging this browser" bar no longer flickers between steps.** BrowserZap now lets go
+  of a tab after 5 minutes without an agent action (was 60 s), and still at once when the session ends, when you take
+  over, hand off or close the panel.
+- **The panel says "Connecting…" while Chrome wakes BrowserZap up**, instead of "offline".
+- **The side panel belongs to one tab.** It opens where you click the toolbar icon (and is available on the agent's
+  tabs) and hides when you switch to another tab. The toolbar badge reads **ON** only on tabs BrowserZap controls, or
+  the number of decisions waiting there.
+- **Closing the side panel hands the tab back.** Comment mode ends (it used to come back on every reload), a recording
+  is dropped, and an agent working there lets go of the tab: it leaves the group, stays open as it is, its overlays go
+  and the debugger detaches. The agent's next page action is told the person took the tab back.
+- **An existing upload is detected** (#65): `file_upload` reports the file already on the input instead of asking for
+  a second approval, and tells the agent to ask before replacing it.
+- **Comment screenshots show context** (#66): each element crop now includes the surrounding page instead of a tight
+  cut-out.
+- No new tools and no new permission; the protocol stays 4, and approvals, hand-off and Stop stay free.
+
 ## 0.6.1 (2026-10-30)
 
 The changes from three real-Chrome runs in the owner's own browser (docs/REVIEW_LATER.md, K-7…K-10). Checked in the

package/README.md

@@ -28,26 +28,30 @@ browser, no copied cookies and no new login: the agent works in your real tab, a
 
 ## Install
 
-```cmd
-npm install -g browserzap
-browserzap setup
-```
+1. **Add the extension from the Chrome Web Store:**
+   <https://chromewebstore.google.com/detail/bbnmhaonicbmljhbahimpgfafbjoijpe>. Chrome keeps it updated for you.
+
+2. **Install the companion program** (the bridge and the MCP server; it needs Node.js 22 or newer):
+
+   ```cmd
+   npm install -g browserzap
+   ```
 
-`browserzap setup` does three things, and is safe to run again:
+3. **Run setup once:**
+
+   ```cmd
+   browserzap setup
+   ```
+
+`browserzap setup` does two things, and is safe to run again:
 
 1. Registers a small helper with Chrome and Edge for your Windows user only (no administrator rights), so the
-   extension connects by itself. There is no token to copy.
-2. Copies the BrowserZap extension to `%USERPROFILE%\BrowserZap\extension` and prints that path.
-3. Finds Claude Code, Codex CLI and Cursor, shows the exact entry it would add for BrowserZap, and adds it only after
+   extension connects by itself and can start the companion program. There is no token to copy.
+2. Finds Claude Code, Codex CLI and Cursor, shows the exact entry it would add for BrowserZap, and adds it only after
    you answer `y`.
 
-Then add the extension to Chrome:
-
-- **From the Chrome Web Store** (in review; this link works once it is published):
-  <https://chromewebstore.google.com/detail/bbnmhaonicbmljhbahimpgfafbjoijpe>. Chrome keeps it updated.
-- **Until then, load it unpacked** (Chrome does not allow this step to be automated):
-  1. Open `chrome://extensions` and turn on **Developer mode**.
-  2. Click **Load unpacked** and choose the folder `setup` printed.
+The npm package ships the bridge, the native helper and the MCP server — **not** the extension. If the extension is
+not installed yet, `setup` prints the store link.
 
 Click the BrowserZap icon to open the side panel. It turns green when it is connected. Check everything with:
 
@@ -58,6 +62,13 @@ browserzap doctor
 Using Claude Code inside WSL? BrowserZap stays on Windows; in WSL run
 `claude mcp add browserzap -- cmd.exe /c browserzap` (details: <https://browserzap.com/docs/platforms>).
 
+### Developers
+
+From a source checkout, `npm run build` still writes `extension/`, which you can load with **Load unpacked** in
+`chrome://extensions` (turn on **Developer mode**). Run `browserzap setup --dev` so the helper accepts that build;
+`setup` without `--dev` goes back to the store extension only. From a checkout without a global install, the same
+command is `node bridge-server/index.js setup --dev`.
+
 ## Use it
 
 Restart your MCP client and ask for something in the browser, for example: *"Open example.com and tell me what the
@@ -88,7 +99,7 @@ Start with `browserzap doctor`: every failed line says what to do.
 | Doctor: *a bridge with a different pairing secret holds 127.0.0.1:9334* | `browserzap restart-bridge`, then **Reconnect** in the side panel |
 | Doctor: *Launcher finds Node and the helper* fails | Node moved (a version switch with fnm, Volta or nvm): run `browserzap setup` again |
 | Doctor: *Not blocked by Chrome policy* fails | Your computer is managed; ask IT to allow the helper `com.browserzap.bridge` and the extension |
-| Chrome says *Disable developer mode extensions* on start-up | Expected while the extension is loaded unpacked. Choose **Keep**; the Chrome Web Store version does not show it |
+| Chrome says *Disable developer mode extensions* on start-up | Only with a developer's unpacked copy: choose **Keep**. The Chrome Web Store install never shows it |
 | A bar says *"BrowserZap" started debugging this browser* | Expected while an agent can act; it goes away when the agent ends or after a minute idle |
 | Your agent does not list BrowserZap's tools | Restart the agent app after `browserzap setup`. To add it by hand, `browserzap --help` prints the exact MCP configuration |
 | A step stops with *"needs you"* | The page asked for a password, a code or an approval. Do it, press **Done**, and the agent continues |
@@ -104,7 +115,7 @@ More: <https://browserzap.com/docs/troubleshooting>.
 | `browserzap doctor` | Checks the helper registration, the launcher, Chrome policy, the extension id and the connection |
 | `browserzap restart-bridge` | Replaces a bridge that will not pair (another install's secret or an old version) |
 | `browserzap run <workflow> --params rows.csv` | Runs a saved workflow without an agent (one row on the free plan) |
-| `browserzap uninstall` | Removes the helper registration and the extension copy; keeps your data |
+| `browserzap uninstall` | Removes the helper registration (and a developer's unpacked copy); keeps your data |
 | `browserzap uninstall --purge` | Also removes your BrowserZap data folder (cannot be undone) |
 
 Environment variables (allowed sites, profile, upload folder, retention, …): <https://browserzap.com/docs/configuration>.
@@ -116,8 +127,9 @@ npm install -g browserzap@latest
 browserzap setup
 ```
 
-A Web Store install updates itself; an unpacked one needs the reload icon on its card in `chrome://extensions`. Your
-workflows, run reports and settings are kept.
+Chrome updates the extension from the Chrome Web Store by itself. Your workflows, run reports and settings are kept.
+If the extension is older than the companion program, the agent's status result says so: Chrome retries on its own, or
+open `chrome://extensions` and press **Update**.
 
 ## Free and Pro
 

package/THIRD_PARTY_NOTICES.md

@@ -78,6 +78,7 @@ No copyleft, source-available-restricted or non-commercial licences are present
 | Package | Licence | Purpose |
 |---|---|---|
 | `ws` | MIT | WebSocket transport for the local bridge |
+| `preact` | MIT | Side-panel UI, bundled into the extension's `sidepanel.js` (Copyright (c) 2015-present Jason Miller) |
 
 ### Build-time only (not redistributed)
 
@@ -85,9 +86,8 @@ No copyleft, source-available-restricted or non-commercial licences are present
 `copy-webpack-plugin`, `@types/chrome` and their transitive dependencies — including all
 packages listed above as Apache-2.0, BSD and CC-BY-4.0.
 
-The extension bundle emitted by webpack contains first-party source plus the webpack
-runtime only; verified from the production build log (`cacheable modules 85.7 KiB`, all
-`./src/...`).
+The extension bundle emitted by webpack contains first-party source, the webpack runtime and,
+since 0.7.0, `preact` in the side panel's `sidepanel.js` (MIT; listed above).
 
 ---
 

package/bridge-server/extension-id.js

@@ -10,7 +10,8 @@
  * The Chrome Web Store signs its own build and does not accept a manifest
  * `key`, so the store build may get a different id. Fill in
  * STORE_EXTENSION_ID from the developer dashboard after the first upload; the
- * native host then lets both builds in (docs/RELEASE.md §3b).
+ * native host then lets both builds in, once `setup --dev` allows the unpacked
+ * one (docs/RELEASE.md §3b).
  *
  * Everything that has to name the extension — the native messaging host
  * manifest's allowed_origins, `browserzap doctor`, the tests — reads the id
@@ -18,11 +19,20 @@
  * changed key fails `doctor` and the tests instead of silently breaking native
  * messaging.
  *
+ * The store build is the only build a user has (D3), so the store id is the
+ * only one allowed by default. `browserzap setup --dev` saves
+ * `{ "allowDevExtension": true }` in the config dir (next to the pairing
+ * secret, user-only permissions) and the unpacked id is allowed on top of it.
+ * Chrome starts the native host itself, so an env var in the user's shell can
+ * never carry that choice (F2): the file can.
+ *
  * Derived from the manifest key in src/manifest.json. Chrome computes:
  *   id = SHA-256(SPKI DER public key), first 16 bytes, each hex nibble 0-f → a-p
  */
 
 const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
 
 /** chrome-extension://gienkaoaimdjmcjdejjanmbkpfakmkno/ */
 const EXTENSION_ID = 'gienkaoaimdjmcjdejjanmbkpfakmkno';
@@ -36,6 +46,9 @@ const ALLOWED_EXTENSION_IDS = Object.freeze([EXTENSION_ID, STORE_EXTENSION_ID].f
 /** Name Chrome uses for the native messaging host; also the registry key's leaf. */
 const HOST_NAME = 'com.browserzap.bridge';
 
+/** Written by `browserzap setup --dev` in the config dir; its absence means store only. */
+const DEV_FLAG_FILENAME = 'allow-dev-extension';
+
 function extensionOrigin(id = EXTENSION_ID) {
   return `chrome-extension://${id}/`;
 }
@@ -45,6 +58,52 @@ function allowedOrigins(ids = ALLOWED_EXTENSION_IDS) {
   return ids.map((id) => extensionOrigin(id));
 }
 
+/**
+ * Whether the saved dev flag in `dir` allows the unpacked developer build.
+ *
+ * Fail closed: a missing, unreadable or malformed file means store only (D4).
+ */
+function devExtensionAllowed(dir) {
+  if (typeof dir !== 'string' || !dir) return false;
+  try {
+    const saved = JSON.parse(fs.readFileSync(path.join(dir, DEV_FLAG_FILENAME), 'utf8'));
+    return saved?.allowDevExtension === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Save (or clear) the dev flag. `setup` calls this before it writes the host
+ * manifest, so the manifest and the host's own check read the same answer.
+ */
+function setDevExtensionAllowed(dir, allowed) {
+  if (typeof dir !== 'string' || !dir) return false;
+  const file = path.join(dir, DEV_FLAG_FILENAME);
+  if (!allowed) {
+    try { fs.rmSync(file, { force: true }); } catch { /* already gone */ }
+    return false;
+  }
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, '{"allowDevExtension":true}\n', { mode: 0o600 });
+  fs.renameSync(tmp, file);
+  return true;
+}
+
+/**
+ * Every extension id the native host may let in: the store id, plus the
+ * unpacked id when `setup --dev` saved the flag.
+ *
+ * `dir` defaults to the config dir, resolved lazily so importing this module
+ * never reads the filesystem or triggers the legacy-folder check.
+ */
+function allowedExtensionIds({ dir } = {}) {
+  const configDir = dir === undefined ? require('./secret').configDir() : dir;
+  const ids = devExtensionAllowed(configDir) ? [EXTENSION_ID, STORE_EXTENSION_ID] : [STORE_EXTENSION_ID];
+  return ids.filter(Boolean);
+}
+
 /**
  * Chrome's extension id for a manifest `key` value (base64 SPKI DER).
  * Returns null when the key is missing or is not a valid public key.
@@ -72,7 +131,11 @@ module.exports = {
   STORE_EXTENSION_ID,
   ALLOWED_EXTENSION_IDS,
   HOST_NAME,
+  DEV_FLAG_FILENAME,
   extensionOrigin,
   allowedOrigins,
+  devExtensionAllowed,
+  setDevExtensionAllowed,
+  allowedExtensionIds,
   extensionIdFromKey,
 };

package/bridge-server/extension-version.js

@@ -0,0 +1,65 @@
+'use strict';
+/**
+ * The extension version the bridge expects (WP5, F4).
+ *
+ * The Chrome Web Store ships the extension and updates it on its own schedule,
+ * so after the 0.7.0 launch the store build will often lag the npm bridge by a
+ * review cycle. The extension's `hello` carries `extensionVersion` (an additive
+ * field; the protocol stays 4), the bridge stores it per profile, and
+ * `browser_status` says plainly when the connected build is older than this
+ * bridge expects.
+ *
+ * Nothing here ever refuses a connection or a call: a missing version means an
+ * older build (≤ 0.6.1), which is exactly the case the notice is for.
+ */
+
+/** The oldest extension build this bridge describes as current. */
+const MIN_EXTENSION_VERSION = '0.7.0';
+
+/**
+ * One numeric part per dot-separated segment. Anything that is not a version at
+ * all counts as 0, so a short, long or odd string still compares instead of
+ * throwing.
+ */
+function versionParts(version) {
+  let text = '';
+  if (typeof version === 'string') text = version.trim();
+  else if (typeof version === 'number' && Number.isFinite(version)) text = String(version);
+  if (!text) return [0];
+  return text.split('.').map((segment) => {
+    const match = /^\d+/.exec(segment.trim());
+    return match ? Number(match[0]) : 0;
+  });
+}
+
+/**
+ * Numeric dot comparison: 0.7.0 > 0.6.1, 0.7 > 0.7.0, 0.7.0.1 > 0.7.0.
+ * Returns -1 when `a` is older, 0 when equal, 1 when newer.
+ */
+function compareVersions(a, b) {
+  const left = versionParts(a);
+  const right = versionParts(b);
+  const length = Math.max(left.length, right.length);
+  for (let i = 0; i < length; i++) {
+    const x = left[i] ?? 0;
+    const y = right[i] ?? 0;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * True only for a real version string that is older than `minimum`. A missing
+ * or non-string version answers false: "unknown" is not the same as "old", and
+ * the caller decides what to say about it.
+ */
+function isOlderThan(version, minimum) {
+  if (typeof version !== 'string' || !version.trim()) return false;
+  return compareVersions(version, minimum) < 0;
+}
+
+module.exports = {
+  MIN_EXTENSION_VERSION,
+  compareVersions,
+  isOlderThan,
+};

package/bridge-server/feedback.js

@@ -96,10 +96,14 @@ function componentOf(c) {
   };
 }
 
-function pageOf(p) {
+function pageOf(p, { optional = false } = {}) {
   const page = p && typeof p === 'object' ? p : {};
   const url = str(page.url, 2000);
-  if (!url || !/^https?:\/\//i.test(url)) throw new FeedbackError('Every comment needs the http(s) page it was made on.');
+  if (!url || !/^https?:\/\//i.test(url)) {
+    // A message typed in the side panel may come from a tab with no web page (chrome://, a new tab).
+    if (optional) return null;
+    throw new FeedbackError('Every comment needs the http(s) page it was made on.');
+  }
   return {
     url,
     title: str(page.title, 200),
@@ -140,11 +144,14 @@ function saveBatch(batch, { now = new Date() } = {}) {
     const n = Number.isInteger(c.n) && c.n > 0 && c.n < 1000 ? c.n : index + 1;
     const shot = imageData(c.screenshot, `The screenshot of comment ${n}`);
     const attachments = Array.isArray(c.attachments) ? c.attachments.slice(0, MAX_ATTACHMENTS) : [];
+    // kind "message": typed in the side panel's message box, not pinned to an element.
+    const message = c.kind === 'message';
     const entry = {
       n,
+      kind: message ? 'message' : 'comment',
       text,
-      page: pageOf(c.page),
-      element: elementOf(c.info),
+      page: pageOf(c.page, { optional: message }),
+      element: message ? null : elementOf(c.info),
       component: componentOf(c.component),
       screenshot: null,
       attachments: [],
@@ -199,7 +206,7 @@ function list({ includeDelivered = false } = {}) {
       id: b.id,
       createdAt: b.createdAt,
       count: b.comments.length,
-      pages: [...new Set(b.comments.map((c) => c.page.url))].slice(0, 5),
+      pages: [...new Set(b.comments.map((c) => c.page?.url).filter(Boolean))].slice(0, 5),
       delivered: b.delivered,
     }));
 }

package/bridge-server/index.js

@@ -4,9 +4,10 @@
  * BrowserZap — entry point.
  *
  * When used as an MCP server (the primary use case), this starts the MCP
- * server, which embeds the WebSocket bridge. The Chrome extension is installed
- * separately; pass --extension to plant a copy under the user's home directory
- * and print the path for a "Load unpacked" install.
+ * server, which embeds the WebSocket bridge. The Chrome extension comes from
+ * the Chrome Web Store and updates itself; a developer working from a source
+ * checkout can pass --extension to copy the built build under the user's home
+ * directory and print the path for a "Load unpacked" install.
  *
  * Derived from Open Browser Control (MIT, Copyright (c) 2026 smankoo) at commit
  * 4e6c262. BrowserZap drops the Firefox target and rebrands.
@@ -17,7 +18,7 @@
  * Standalone:
  *   node bridge-server/index.js                 # MCP mode (default)
  *   node bridge-server/index.js --bridge        # standalone WebSocket bridge
- *   node bridge-server/index.js --extension     # install + print the extension path
+ *   node bridge-server/index.js --extension     # copy + print the built extension (developer)
  *   node bridge-server/index.js --uninstall     # remove the installed extension copy
  *   node bridge-server/index.js --print-token   # print the pairing token
  */
@@ -28,6 +29,7 @@ const os = require('os');
 
 const { getOrCreateSecret, secretPath, configDir } = require('./secret');
 const { DEFAULT_PORT } = require('./server');
+const { STORE_URL } = require('./setup');
 
 const args = process.argv.slice(2);
 
@@ -82,18 +84,29 @@ function syncDir(src, dest) {
   prune(dest, dest);
 }
 
+/**
+ * The extension build inside this package, or null.
+ *
+ * npm ships the bridge only (D3), so an installed copy has neither folder and
+ * nothing to copy. A source checkout has extension/ after `npm run build`, or
+ * dist/chrome when webpack output is all that exists yet.
+ */
+function builtExtensionDir() {
+  for (const candidate of [path.join(__dirname, '..', 'extension'), path.join(__dirname, '..', 'dist', 'chrome')]) {
+    if (fs.existsSync(path.join(candidate, 'manifest.json'))) return candidate;
+  }
+  return null;
+}
+
 function installExtension({ quiet = false } = {}) {
   const say = quiet ? () => {} : log;
-  const bundled = path.join(__dirname, '..', 'extension');
-
-  if (!fs.existsSync(path.join(bundled, 'manifest.json'))) {
-    // Dev mode — fall back to the raw webpack output.
-    const devDist = path.join(__dirname, '..', 'dist', 'chrome');
-    if (fs.existsSync(path.join(devDist, 'manifest.json'))) {
-      syncDir(devDist, EXTENSION_HOME);
-      return true;
-    }
-    say('Pre-built extension not found. Run "npm run build" first.');
+  const bundled = builtExtensionDir();
+
+  if (!bundled) {
+    // The store is the install path for a user; this flag is a developer tool.
+    process.stdout.write('The extension is not part of the npm package. Install it from the Chrome Web Store:\n');
+    process.stdout.write(`  ${STORE_URL}\n`);
+    process.stdout.write('(Chrome keeps it updated. "browserzap --extension" only works from a source checkout.)\n');
     return false;
   }
 
@@ -119,8 +132,9 @@ function installExtension({ quiet = false } = {}) {
   say(`  4. Select: ${EXTENSION_HOME}`);
   say('');
   say('One-time setup (registers the native messaging host, so the extension');
-  say('connects automatically with no token to paste):');
-  say('  browserzap setup');
+  say('connects automatically with no token to paste; --dev lets this unpacked');
+  say('build in, which the store build does not need):');
+  say('  browserzap setup --dev');
   say('');
   return true;
 }
@@ -277,13 +291,10 @@ if (require('./setup').insideWsl() && !process.env.BROWSERZAP_ALLOW_LINUX) {
 const SUBCOMMANDS = new Set(['setup', 'doctor', 'uninstall', 'run', 'restart-bridge']);
 
 if (command === 'setup') {
-  // From an installed package, copy the extension to a folder that outlives an
-  // upgrade or an npm cache clean, so "Load unpacked" names a path that stays
-  // valid. A source checkout loads its own extension/ folder.
-  const checkout = fs.existsSync(path.join(__dirname, '..', 'src', 'manifest.json'));
-  const extensionPath = checkout
-    ? path.join(__dirname, '..', 'extension')
-    : installExtension({ quiet: true }) ? EXTENSION_HOME : null;
+  // A source checkout has a built extension to load unpacked; an npm install has
+  // none, and the store build is the extension there (D3). Nothing is copied:
+  // setup only names the path a developer already has.
+  const extensionPath = builtExtensionDir();
   require('./setup').setupCommand(args.slice(1), { extensionPath })
     .then((code) => process.exit(code))
     .catch((err) => {
@@ -493,6 +504,7 @@ browserzap — let an AI agent act on the browser tab you already have open.
 Usage:
   browserzap setup                      One-time setup: register the native messaging host and
                                         optionally add the MCP server to detected clients
+  browserzap setup --dev                Allow the unpacked developer build to connect (store-only otherwise)
   browserzap doctor                     Check the host manifest, registry, extension id and bridge
   browserzap restart-bridge             Replace a bridge that will not pair (another secret or version)
   browserzap uninstall [--purge]        Remove the host registration and installed extension copy
@@ -501,7 +513,7 @@ Usage:
                                         more than one). Exit code 0 when every run completed
   browserzap                            Start the MCP server (default)
   browserzap --bridge                   Start the standalone WebSocket bridge
-  browserzap --extension                Install + print the extension path
+  browserzap --extension                Developer: copy the built extension to the install folder (source checkout only)
   browserzap --uninstall                Remove the installed extension copy (keeps your data)
   browserzap --uninstall --purge
                                         Also remove the config folder (pairing token,

package/bridge-server/limits.js

@@ -36,7 +36,7 @@ const LIMITS = Object.freeze({
   /** Longest per-step pacing a person may set on a saved workflow step. */
   MAX_STEP_PACING_MS: 30000,
   /** A tab with no agent action for this long is detached, so Chrome's "debugging" bar goes away (D-35). */
-  DEBUGGER_IDLE_MS: 60000,
+  DEBUGGER_IDLE_MS: 300000,
   /** Tabs a session may have while it works (main + helpers); one more closes the least recently used helper (D-38). */
   MAX_SESSION_TABS: 5,
   /** Tabs a session keeps once it has been idle for TAB_TRIM_IDLE_MS. */