browserzap 0.7.0 → 0.8.5

package/CHANGELOG.md

@@ -1,5 +1,229 @@
 # Changelog
 
+## 0.8.5 — typing that editors accept, fewer prompts (2026-11-05)
+
+A blocker fix for text input. On Medium (and in Gmail, LinkedIn, X, Slack and Notion) the agent's typing could look
+right on screen while the editor itself rejected it — Medium showed “Something is wrong and we cannot save your
+story” and BrowserZap still said “verified”. Typing now goes through Chrome's own input channel, at the caret, exactly
+as your keyboard does, and “verified” means the page kept the text.
+
+**Permissions: fewer prompts, same safety**
+- **Preparation goes ahead, a final action asks.** Attaching a file you named no longer asks. Submitting, sending,
+  deleting and paying still ask: **Approve once**, **Deny**, or the new **Always allow on this site**.
+- **Settings → Permissions.** Set each kind of action to Allow, Ask or Block, and see (and remove) the sites you
+  allowed. Block always wins; payments can only Ask or Block; the agent can never change these settings.
+
+**Settings on their own page**
+- The gear in the side panel opens a full Settings page (also Chrome's “Options” for BrowserZap): General,
+  Permissions, Plan, Help and Advanced, laid out for a wide window and for a phone-width one.
+
+**Writing in editors (found writing a real Medium story)**
+- **Every character is a real keystroke**, as Chrome sends it for your keyboard (Shift included). Medium ignored text
+  that arrived any other way while BrowserZap reported it as kept.
+- **The agent types where it clicked.** Click a title, then fill: the text goes into the title, not to the end of the
+  story. Clicking the text of an editor never asks for approval, whatever words it contains.
+- **Uploads behind a button.** `file_upload` accepts a button like “Add an image”: BrowserZap catches the file chooser
+  the page opens (no dialog appears) and attaches the file you approved — Medium, Gmail and Notion work this way.
+- **Honest results:** a list that “1. ” turned into is reported as converted, not lost; quotes the page curls are
+  “reformatted”; an icon-only toolbar button gets a name from its icon or hint (`nameSource: "hint"`).
+
+**The agent's cursor**
+- White with an orange outline, the same on light and dark pages. It stays on the element it acted on when the page
+  scrolls, and a cursor left behind by an extension reload is removed instead of shown twice.
+
+**Typing**
+- **Rich editors accept what the agent types.** BrowserZap no longer rewrites an editor's page. It clicks where the
+  caret belongs and types there, so the editor sees the same events as a person's keyboard: Medium, Gmail, LinkedIn,
+  X, Slack, Notion and comment boxes work.
+- **A whole document is never cleared.** When the editor holds several blocks (Medium's story editor), the text is
+  added at the end of the last block, and the result says so. A single block is replaced only when that is what you
+  asked for.
+- **Every keystroke is real.** Search boxes show suggestions as the agent types, autocompletes open, phone and card
+  masks format, character counters count, and shortcuts work — because the page receives real key events, not a
+  silent value change.
+- **`verified` is honest.** BrowserZap reads the field back after a moment. If the page kept the text but reformatted
+  it (a phone mask, uppercase in a controlled field), the result says “reformatted by the page”. If it did not keep it,
+  the call fails with “the page did not keep the text” instead of pretending.
+- **Background tabs behave like the tab in front.** The agent types and clicks without bringing your tab forward, and
+  without you losing your place.
+
+**Keys, hover and scrolling**
+- **Any key, and shortcuts.** `browser_press_key` now takes letters, digits and chords such as `ctrl+b`, `ctrl+k`,
+  `ctrl+a`, `ctrl+alt+1` and `ctrl+enter`. A bad key is refused before anything happens. Enter and Ctrl+Enter keep the
+  same approval rule when they would submit or send.
+- **Hover.** New `element_hover`: menus, tooltips and buttons that appear only on hover can now be reached. It is
+  read-only, and it reports what appeared.
+- **Scrolling loads more.** `browser_scroll` sends a real mouse wheel, so infinite lists and wheel-driven widgets load
+  the next page. The old behaviour is the fallback.
+
+**Tabs**
+- **Your agent keeps its tab.** If you click, type or navigate in the agent's tab, or look at another tab in its
+  group, the agent carries on in its own tab instead of stopping. Its next result says what changed while it was away
+  (address, title, whether fields were filled or emptied — never the values) and tells it to look at the page first.
+- **A tab you shared still comes back** when you close its panel. Opening or closing the panel on a tab the agent
+  opened changes nothing.
+- **Tab groups say BrowserZap.** An agent's group is titled `BrowserZap · claude-code` (or the name the agent gave
+  its session), so its tabs are easy to tell apart from another extension's groups.
+
+**Updates**
+- **Store updates install without a Chrome restart.** BrowserZap's connection to the bridge kept Chrome from ever
+  installing a downloaded update until the browser restarted. It now reloads into the new version as soon as no agent
+  is working, no side panel is open and Comment mode is off. A developer (unpacked) copy still needs its reload button.
+- **No new permissions.** Same Chrome Web Store permissions as 0.8.0.
+
+## 0.8.0 — the connection fix and chat (2026-11-04)
+
+Compared with the last public release (0.7.0). Only finished, tested work is listed. Everything is free during early
+access; nothing that keeps you safe (approvals, hand-off, Stop) will ever be paid.
+
+**It connects, and stays connected**
+- **The side panel no longer sticks on "Connecting…".** If the connection came up before the panel started listening,
+  0.7.0 could show "Connecting…" forever while everything underneath worked. The panel now always picks it up.
+- **The bridge comes back by itself after the extension reloads or updates.** Chrome updating BrowserZap no longer
+  leaves it waiting until your agent's next call or a manual `browserzap --bridge`.
+- **Profile names stay put.** An unnamed profile keeps its number ("Profile 1") across reconnects and restarts, and
+  renaming one profile never changes another.
+
+**Chat with your agent in the side panel**
+- **Type to your agent in any tab's panel**, or point at elements and ask about them in the same message.
+- **Your agent can listen** (`feedback_wait`): ask it to "listen to me in BrowserZap" and it answers as soon as you
+  write; the panel shows when it is listening. It replies in the tab you wrote from (`chat_reply`).
+- **Each message goes to the agent working in that tab**, never to another agent you have open.
+- **Each tab group's panel shows its own conversation**, not everything the agent did elsewhere.
+- **A message is never lost because the agent went away.** If the agent you wrote to has ended, the message is handed
+  to the next agent for that tab instead of sitting unread. The panel tells you which happened: "Sent to … — it reads
+  this on its next step", or "Saved. No agent is connected to this tab right now; the next one reads it."
+- **You can see it working.** The panel shows a one-line status ("● Claude is working: Clicking “Submit”") while a
+  call is in flight, and flips to a reply in the same tab as soon as the agent answers.
+- **The conversation stays with the tab.** Close the panel, switch tabs, or restart Chrome and the tab's chat is still
+  there, stored on your computer and compressed (Settings → Chat history: 7 days, 30 days, or off). Clear conversation
+  really clears it.
+- **And only with that tab.** Close a tab and its chat goes with it; reopen the tab (Ctrl+Shift+T) or let Chrome
+  restore it and the chat comes back. A new tab on the same site starts a fresh conversation.
+- **Answers arrive as soon as you send.** A listening agent is told the moment you press Send, instead of noticing on
+  its next check.
+- **A calmer conversation.** Connection messages stay in the header, and a long run of agent steps folds to its last
+  two, with the earlier ones a click away.
+
+**Free during early access**
+- **No limit on saved workflows** (0.7.0 kept 10).
+
+**Clearer approvals**
+- **The approval card says who presses the button:** "Press Approve once here — the agent then presses the button
+  itself."
+- **Picking a tab, radio button or option no longer asks for approval** because its label says "Approve" or "Delete";
+  buttons, links and consent checkboxes still do.
+
+**Settings, redesigned**
+- Clear sections for this browser (connection, version, the profile name agents see), the plan, help links, and the
+  advanced pairing options.
+
+**Also in this release**
+
+**Work with your agent in more than one tab**
+- **Open BrowserZap on any tab and it joins your agent.** With one agent connected, opening the side panel on a tab
+  gives the agent that tab as a new workspace: its own Chrome tab group labelled "<agent> · <site>", up to four per
+  agent. The agent is told and switches to it when it needs it; nothing moves under it.
+- **Several agents side by side.** Run two agents (two Claude Code or Codex windows) and each keeps to its own tab
+  groups. When you open the panel on a new tab, it asks which agent the tab is for. One agent can never act in
+  another's tabs.
+- **Your tabs stay yours.** Tabs you bring in from the panel are never closed or trimmed by the agent, and closing a
+  tab's panel hands that tab back as it is.
+- **No more duplicate tabs after a restart.** When Chrome restarts BrowserZap's background service (after a while
+  idle, or when the extension updates), your agent takes back its own tab and group instead of opening new ones.
+
+**Clearer on the page**
+- **The approval card never covers a form field.** Approve once / Deny sits beside or below the button it asks
+  about, on the button's row, clear of every input.
+- **A new agent cursor:** a gold arrow (Lucide's mouse pointer). While the agent types, the arrow steps aside and the
+  field's own blinking caret shows where the text goes, with the field's name beside it — never the value.
+- **Panels on other tabs say where your agent is** ("working in another tab", with Show), and every tab whose panel
+  is open is marked **ON** in the toolbar.
+- **Two copies of BrowserZap in one profile are called out** (for example the store version and a developer build),
+  with which one to turn off. Unnamed Chrome profiles get distinct names.
+- First visit explains Chrome's "BrowserZap started debugging this browser" bar, and that pressing Cancel stops the
+  agent. The status pills in Workflows are easier to read (higher contrast), and the panel uses Lucide icons.
+
+**More accurate results**
+- A click that submits a form now reports a navigation that happens a moment later, instead of "no change".
+- Chrome's debugging bar no longer flickers mid-task (BrowserZap lets go after 5 idle minutes, and at once when the
+  agent finishes).
+
+**For developers**
+- `browserzap setup` names the store extension id it registered in store-only mode.
+- `npm run release:changes`, `release:public` and `release:internal` (docs/RELEASE_CHECKLIST.md).
+
+## 0.8.0 (internal)
+
+**Internal only.** Built and installed from the checkout for the owner's own use (`browserzap-0.8.0.tgz`, packed
+locally); never published to npm, the Chrome Web Store or the website. Branch `integration/0.8` → `release/0.8`.
+Full browser suite and unit tests: see docs/releases/0.8.0-internal.md.
+
+### Tabs, workspaces and several agents
+- **Workspaces.** Opening the side panel on a tab with one agent connected adds the tab to that session as a new
+  workspace group "<agent> · <site>" (≤ 4 groups per session, `MAX_WORKSPACES_PER_SESSION`). Panels already open when
+  an agent connects join it too. The agent gets a note on its next call; `browser_list_tabs` returns
+  `role: "workspace"` and `workspace: "<label>"` (read back from Chrome after a restart). Workspace tabs are the
+  person's (`sharedTabs`): never trimmed, kept and ungrouped when the session ends, released when their panel closes.
+- **Several agents.** With more than one agent connected the panel shows a picker (`join_tab`); nothing joins on its
+  own. `tabBelongs` checks the session's group and its workspace groups; another session's tab is
+  `PERMISSION_REQUIRED`. Proven with two real MCP clients interleaving navigate, fill, chat, approval and click (B-04,
+  `concurrent-agents.e2e.mjs`).
+- **"Work here".** Sharing a tab when exactly one agent is connected moves that agent there (`giveTabToAgent`): the
+  tab joins its group, becomes its session tab, and the next page action is stopped once with the reason
+  (`tabNotice`, D-21). Panels on tabs without an agent name the agent busy elsewhere, with Show; the header says
+  "N agents in another tab".
+- **Reclaim after a restart.** The saved session map is merged, not overwritten (`persistSessions`), so the first
+  session to come back after a service-worker restart no longer erases the others; an entry is removed only when its
+  session ends (`forgetSavedSession`). A debugger attachment left by the previous worker is taken back
+  (`reclaimOwnAttachment`: only our own attachment can be detached) instead of failing with "Another debugger is
+  already attached".
+- **The bridge comes back by itself (B-10).** After an extension reload, a paired extension now asks the native
+  helper to start the bridge when its connection fails, instead of waiting for an agent or a manual
+  `browserzap --bridge`. The helper runs ensure-bridge, the extension reconnects, and it stops asking while the
+  connection is healthy.
+- **Debugger hold on the action's tab.** The no-detach-mid-action hold now covers the tab an action actually runs on
+  (a session's first tab, or one switched to mid-call), not only the session tab at the start of the call.
+
+### Side panel and page
+- **Chat (internal, Pro).** The message box is on in internal builds (`src/sidepanel/features.ts`); a message is a
+  feedback batch with `kind: "message"`; every tool result reminds the agent until `feedback_get`; `chat_reply`
+  answers in the panel (offered with `BROWSERZAP_EXPERIMENTAL=chat`). Before any public release it must be off or
+  gated by the licence.
+- **Approval card placement** (B-01): every candidate spot is first moved on screen, then judged by what it covers
+  (other controls and the marked element itself); if none is clear it slides along the same rows until it is; on a
+  page with no clear spot it takes the one that covers least. Rules unchanged: trusted clicks only, `tabIndex = -1`,
+  out of the agent's reach.
+- **Cursor:** Lucide `mouse-pointer-2`, gold (`#f5b335`) with a dark outline. The drawn I-beam caret is removed: a
+  typing step hides the arrow (decided by the step, not by focus) and shows only the field's name.
+- **Icons:** `lucide-preact` (ISC) for the panel's settings, send, pin, copy and close; brand marks unchanged.
+- **ON badge** on every tab whose panel is open (B-03); duplicate-build warning and never-reused profile numbers
+  (B-05); the debugging bar explained on first visit (B-08); darker text on the status pills (axe contrast).
+- The panel subscribes to state in a layout effect and connects its tab port at load, so a panel that has not painted
+  yet still receives updates and hands its tab back when closed.
+- Late navigation after a click that started a request is reported (B-02, `NAVIGATION_FOLLOW_MS`).
+
+### Tests and release tooling
+- **Browser suite: ~15 → ~12 minutes** for the full lane: compile-time E2E build (`build:e2e` → `extension-e2e/`,
+  short `DEBUGGER_IDLE_MS` / `TAB_TRIM_IDLE_MS` / `SESSION_GRACE_MS`; production values pinned by the contract test),
+  `expect` on clicks, `until()` instead of fixed sleeps, grouped files, lanes `test:e2e:fast`, `test:e2e`,
+  `test:e2e:real-timers`. The debugger idle case dropped from 5 min to ~5 s.
+- **New checks:** console/exception guard on BrowserZap's own pages and worker, panel layout at 320/420/600 px,
+  axe-core accessibility, keyboard flow, service-worker suspension, orphan-process and redaction scans, failure
+  bundles in `artifacts/e2e-failures/`, JSON timings.
+- **Build guard:** the E2E build compiles into `dist/chrome-e2e` with a marker the store packager refuses.
+- **Fixed traps:** the harness no longer attaches to web pages (it made every tab look "debugged" and held up new
+  tabs); `test:e2e` always runs every test — re-running only failures is `test:e2e:rerun-failed`, never a release
+  lane.
+- Store records per release (`docs/store/`, browser view `docs/store/index.html`) and the public/internal release
+  checklist (`docs/RELEASE_CHECKLIST.md`) — shipped with 0.7.0's records.
+
+### Cleanup
+- 13 finished worktrees and 46 merged local branches removed; 33 merged remote branches deleted (backup bundle first);
+  GitHub deletes head branches on merge. Finished plans and reports moved to `docs/archive/` (links updated).
+  Branch, worktree and push-batching rules in `docs/DEVELOPMENT_WORKFLOW.md`. Architecture plan:
+  `docs/design/FEATURE_MODULES.md`.
+
 ## 0.7.0 — public launch
 
 BrowserZap is public: free, and installed from the Chrome Web Store.
@@ -48,7 +272,7 @@ BrowserZap is public: free, and installed from the Chrome Web Store.
 
 ## 0.6.1 (2026-10-30)
 
-The changes from three real-Chrome runs in the owner's own browser (docs/REVIEW_LATER.md, K-7…K-10). Checked in the
+The changes from three real-Chrome runs in the owner's own browser (docs/archive/REVIEW_LATER.md, K-7…K-10). Checked in the
 owner's Chrome: `npm run check:chrome` 9/9, approval through the page card, the test tab closed at session end.
 
 - **No more tabs left behind.** The tab group is the contract: while the agent is connected its tabs stay open in the
@@ -104,7 +328,7 @@ A replay now waits for what the step is actually blocked on, and retries that st
 
 ## 0.5.5 (2026-10-30)
 
-Comment mode, debugging tools, files, Edge and WSL, a much better doctor, and the Chrome Web Store build. Known items to review are listed in docs/REVIEW_LATER.md (upload approval visibility, a file the person picks themselves, a download re-test, wider Comment screenshots, a calmer side panel).
+Comment mode, debugging tools, files, Edge and WSL, a much better doctor, and the Chrome Web Store build. Known items to review are listed in docs/archive/REVIEW_LATER.md (upload approval visibility, a file the person picks themselves, a download re-test, wider Comment screenshots, a calmer side panel).
 
 - No more stuck file dialogs: when the agent clicks a page's "Choose file" control, no Windows file picker opens; the result says the page asked for a file and to use `file_upload`. Your own clicks open the picker as usual. If Chrome is set to ask where to save each download, `browserzap doctor` and `browser_downloads` say so and how to turn it off (an extension cannot skip that dialog).
 - Messages for people who installed from npm: the side panel, the extension and the agent no longer point to source-only commands (`npm run health`, `npm run bridge:restart`, …) but to `browserzap doctor`, `browserzap restart-bridge`, `browserzap --print-token`. When a bridge from another install holds the port, the side panel now says so and shows the fix instead of staying grey.

package/THIRD_PARTY_NOTICES.md

@@ -79,6 +79,7 @@ No copyleft, source-available-restricted or non-commercial licences are present
 |---|---|---|
 | `ws` | MIT | WebSocket transport for the local bridge |
 | `preact` | MIT | Side-panel UI, bundled into the extension's `sidepanel.js` (Copyright (c) 2015-present Jason Miller) |
+| `lucide-preact` | ISC | Side-panel icons, bundled into `sidepanel.js`; the page cursor draws Lucide's `mouse-pointer-2` path (Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather (MIT); all other copyright (c) for Lucide are held by Lucide Contributors 2022) |
 
 ### Build-time only (not redistributed)
 

package/bridge-server/background-runs.js

@@ -257,7 +257,7 @@ function createRunRegistry({ execute, onFinish = () => {}, now = Date.now }) {
 /**
  * The part of a finished batch an agent needs: counts and, per set that did not
  * complete, where and why. Everything else is in the report. Kept well under
- * 700 bytes per set (docs/NEXT_RELEASE_SCOPE.md P0-5).
+ * 700 bytes per set (docs/archive/NEXT_RELEASE_SCOPE.md P0-5).
  */
 function compactBatch(result) {
   const ev = result?.evidence ?? {};

package/bridge-server/entitlements.js

@@ -2,9 +2,8 @@
  * BrowserZap — plan and entitlements (docs/ADR/ADR-006-free-pro-boundary.md).
  *
  * The free core is everything that keeps an agent safe and useful on its own:
- * every browser tool, approvals, handoff, honest errors and basic workflows.
- * Pro adds workflow history, bulk runs, run reports and more than
- * FREE_LIMITS.workflows saved workflows. Nothing here ever gates a safety check.
+ * every browser tool, approvals, handoff, honest errors and workflows.
+ * Pro adds workflow history, bulk runs and run reports. Nothing here ever gates a safety check.
  *
  * A licence is a signed token issued by the licence service after payment:
  *
@@ -36,15 +35,18 @@ const LICENSE_FILENAME = 'license';
 const GRACE_DAYS = 14;
 const DAY_S = 24 * 60 * 60;
 
-/** Limits that apply without a licence. */
-const FREE_LIMITS = Object.freeze({ workflows: 10 });
+/**
+ * Limits that apply without a licence. Early access (owner decision 2026-11-03, docs/DECISIONS.md D-0.8-1): no
+ * limit on saved workflows; the site promises every shipped feature free. A cap returns only with notice on the site.
+ */
+const FREE_LIMITS = Object.freeze({});
 
 /** Every Pro feature, with the text shown when it is missing. */
 const PRO_FEATURES = Object.freeze({
   'workflow.history': 'keeps every saved version of a workflow and can run or restore an older one',
   'workflow.bulk': 'runs one workflow over many parameter sets in a single call',
   'workflow.reports': 'keeps a local report of every workflow run',
-  'workflow.unlimited': `saves more than ${FREE_LIMITS.workflows} workflows`,
+  'workflow.unlimited': 'saves any number of workflows',
 });
 
 const PLAN_FEATURES = Object.freeze({

package/bridge-server/feedback.js

@@ -174,7 +174,11 @@ function saveBatch(batch, { now = new Date() } = {}) {
 
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   for (const [name, data] of files) writePrivate(path.join(dir, name), data);
-  const record = { id, createdAt: now.toISOString(), delivered: false, deliveredAt: null, comments: stored };
+  // The agent session this batch is for (the owner of the panel's tab); null means any agent may read it.
+  const session = typeof batch.session === 'string' && /^[\w-]{1,64}$/.test(batch.session) ? batch.session : null;
+  // The tab the person wrote from: whoever reads the batch answers there, even when no agent owned the tab.
+  const tabId = Number.isInteger(batch.tabId) && batch.tabId >= 0 ? batch.tabId : null;
+  const record = { id, createdAt: now.toISOString(), session, tabId, delivered: false, deliveredAt: null, comments: stored };
   writePrivate(path.join(dir, 'batch.json'), JSON.stringify(record, null, 2));
   prune({ now: now.getTime() });
   return { id, dir, count: stored.length };
@@ -197,25 +201,32 @@ function batchIds() {
   }
 }
 
-/** Newest first: { id, createdAt, count, pages, delivered }. */
-function list({ includeDelivered = false } = {}) {
-  return batchIds().reverse()
+/** A batch addressed to another agent session is not this session's to read. */
+function forSession(batch, session) {
+  return !session || !batch.session || batch.session === session;
+}
+
+/** Newest first (oldest first with `oldest`): { id, createdAt, count, pages, delivered, session }. */
+function list({ includeDelivered = false, session = null, oldest = false } = {}) {
+  const ids = batchIds();
+  return (oldest ? ids : ids.reverse())
     .map((id) => readBatch(id))
-    .filter((b) => b && (includeDelivered || !b.delivered))
+    .filter((b) => b && (includeDelivered || !b.delivered) && forSession(b, session))
     .map((b) => ({
       id: b.id,
       createdAt: b.createdAt,
       count: b.comments.length,
       pages: [...new Set(b.comments.map((c) => c.page?.url).filter(Boolean))].slice(0, 5),
       delivered: b.delivered,
+      session: b.session ?? null,
     }));
 }
 
-/** One batch with absolute file paths, or the newest one not yet delivered. */
-function get(id) {
-  const chosen = id ?? list()[0]?.id;
+/** One batch with absolute file paths, or the newest (`oldest`: oldest) one not yet delivered to this session. */
+function get(id, { session = null, oldest = false } = {}) {
+  const chosen = id ?? list({ session, oldest })[0]?.id;
   const batch = chosen ? readBatch(chosen) : null;
-  if (!batch) return null;
+  if (!batch || !forSession(batch, session)) return null;
   const dir = path.join(feedbackDir(), batch.id);
   return {
     ...batch,
@@ -228,6 +239,26 @@ function get(id) {
   };
 }
 
+/**
+ * A message addressed to an agent that has gone must not stay unreadable. Every
+ * undelivered batch stamped with a session that is not live loses the stamp
+ * (null = any agent may read it). Called when an agent session ends, and once at
+ * bridge start, which sweeps whatever a killed bridge left behind.
+ */
+function releaseOrphans({ session = null, liveSessionIds = new Set() } = {}) {
+  let released = 0;
+  for (const id of batchIds()) {
+    const batch = readBatch(id);
+    if (!batch || batch.delivered || !batch.session) continue;
+    if (session && batch.session !== session) continue;
+    if (liveSessionIds.has(batch.session)) continue;
+    batch.session = null;
+    writePrivate(path.join(feedbackDir(), id, 'batch.json'), JSON.stringify(batch, null, 2));
+    released++;
+  }
+  return released;
+}
+
 function markDelivered(id, { now = new Date() } = {}) {
   const batch = readBatch(id);
   if (!batch || batch.delivered) return false;
@@ -237,8 +268,8 @@ function markDelivered(id, { now = new Date() } = {}) {
   return true;
 }
 
-function pendingCount() {
-  return list().length;
+function pendingCount({ session = null } = {}) {
+  return list({ session }).length;
 }
 
 /** Delete batches older than the retention, and the oldest beyond MAX_BATCHES. Never throws. */
@@ -259,4 +290,4 @@ function prune({ now = Date.now(), days = keepDays() } = {}) {
   return removed;
 }
 
-module.exports = { saveBatch, list, get, markDelivered, pendingCount, prune, feedbackDir, FeedbackError, MAX_COMMENTS };
+module.exports = { saveBatch, list, get, markDelivered, pendingCount, releaseOrphans, prune, feedbackDir, FeedbackError, MAX_COMMENTS };

package/bridge-server/limits.js

@@ -22,6 +22,13 @@ const LIMITS = Object.freeze({
   APPROVAL_HOLD_MS: 20000,
   /** A click or key press without `expect` watches this long for the page to react. */
   DEFAULT_SETTLE_MS: 1500,
+  /**
+   * After a click started a request, how long to keep watching for a navigation
+   * once the page has settled. A form POST in a background tab can navigate a
+   * moment after the visible change, and the evidence must not say `navigated:
+   * false` (B-02). A bounded poll, never a fixed sleep.
+   */
+  NAVIGATION_FOLLOW_MS: 1200,
   /** Before acting, the page must have had no tracked request in flight for this long. */
   SETTLE_QUIET_MS: 500,
   /** How long that settle waits for a busy page (it costs nothing on a quiet one). */
@@ -93,7 +100,8 @@ function callDeadlineMs(tool, args = {}) {
     case 'element_click':
       // find the target, maybe hold for an approval, then watch the result
       waits = (asked ?? LIMITS.DEFAULT_TARGET_WAIT_MS) + LIMITS.APPROVAL_HOLD_MS
-        + (asked ?? (args?.expect ? LIMITS.DEFAULT_EXPECT_TIMEOUT_MS : LIMITS.DEFAULT_SETTLE_MS));
+        + (asked ?? (args?.expect ? LIMITS.DEFAULT_EXPECT_TIMEOUT_MS : LIMITS.DEFAULT_SETTLE_MS))
+        + LIMITS.NAVIGATION_FOLLOW_MS;
       break;
     case 'browser_press_key':
       waits = LIMITS.APPROVAL_HOLD_MS + LIMITS.DEFAULT_SETTLE_MS;
@@ -114,9 +122,20 @@ function callDeadlineMs(tool, args = {}) {
   return Math.max(CALL_DEADLINE_MS, waits + DEADLINE_MARGIN_MS);
 }
 
+/**
+ * feedback_wait (the chat listener): how long one call waits for the person by default and at most, and how often
+ * it looks. A bounded poll of the local feedback folder (ADR-007); progress keeps the client from timing out.
+ */
+const FEEDBACK_WAIT_DEFAULT_MS = 60_000;
+const FEEDBACK_WAIT_MAX_MS = 300_000;
+const FEEDBACK_POLL_MS = 500;
+
 module.exports = {
   LIMITS,
   CALL_DEADLINE_MS,
+  FEEDBACK_WAIT_DEFAULT_MS,
+  FEEDBACK_WAIT_MAX_MS,
+  FEEDBACK_POLL_MS,
   STATUS_DEADLINE_MS,
   RUN_DEADLINE_MS,
   MAX_STEP_RESOLVE_MS,

package/bridge-server/mcp-server.js

@@ -30,7 +30,7 @@ const path = require('path');
 const { getOrCreateSecret, configDir } = require('./secret');
 const { BIND_HOST, DEFAULT_PORT, PROTOCOL_VERSION, sanitizeSessionName } = require('./server');
 const { ensureBridge: ensureBridgeListening } = require('./ensure-bridge');
-const { LIMITS, CALL_DEADLINE_MS, STATUS_DEADLINE_MS } = require('./limits');
+const { LIMITS, CALL_DEADLINE_MS, STATUS_DEADLINE_MS, FEEDBACK_WAIT_DEFAULT_MS, FEEDBACK_WAIT_MAX_MS, FEEDBACK_POLL_MS } = require('./limits');
 const chromeLauncher = require('./chrome-launcher');
 const { MIN_EXTENSION_VERSION, isOlderThan } = require('./extension-version');
 const { MCP_TOOLS, LOCAL_TOOLS, validateArguments } = require('./tools');
@@ -161,6 +161,12 @@ function connectToBridge() {
       }
       return;
     }
+    // The person sent a message or notes from the side panel: a waiting feedback_wait reads it now (feedbackWait).
+    if (msg.type === 'event' && msg.event === 'feedback_new') {
+      if (feedbackWaiters.size) log('feedback_nudged', { waiting: feedbackWaiters.size });
+      feedbackWaiters.forEach((wake) => wake());
+      return;
+    }
     // The person pressed Stop on the page (or took control in the side panel):
     // a background batch stops with the step in flight.
     if (msg.type === 'event' && msg.event === 'user_handoff') {
@@ -224,6 +230,26 @@ function updateSessionName(name) {
   }
 }
 
+/** Running feedback_wait calls, woken by the bridge's feedback_new event; the folder poll stays as the fallback. */
+const feedbackWaiters = new Set();
+
+/** The side panel shows "listening" while feedback_wait runs. */
+function updateListening(listening) {
+  if (sessionStarted && ws?.readyState === WebSocket.OPEN) {
+    ws.send(JSON.stringify({ type: 'session_update', session: SESSION_ID, listening }));
+  }
+}
+
+/**
+ * The tab the last batch came from: the extension shows this session's replies there. Needed when the person
+ * writes from a tab no agent owned — the batch is unaddressed, but the answer still belongs in that tab.
+ */
+function updateChatTab(tabId) {
+  if (sessionStarted && ws?.readyState === WebSocket.OPEN && Number.isInteger(tabId) && tabId >= 0) {
+    ws.send(JSON.stringify({ type: 'session_update', session: SESSION_ID, chatTabId: tabId }));
+  }
+}
+
 /** Requests answered by the bridge itself (Chrome profiles), matched by id. */
 const bridgeReplies = new Map();
 let bridgeSeq = 0;
@@ -486,7 +512,7 @@ async function callToolWith(progress, requestId, toolName, args) {
     // The person can message the agent from the side panel at any time; the
     // agent learns of it on its next call. browser_status says it itself.
     if (toolName !== 'browser_status' && !toolName.startsWith('feedback_') && typeof env.summary === 'string') {
-      const waiting = feedback.pendingCount();
+      const waiting = feedback.pendingCount({ session: SESSION_ID });
       if (waiting) env.summary = `${env.summary} ${unreadFeedbackNote(waiting)}`;
     }
     log('tool_call', {
@@ -526,6 +552,11 @@ async function callToolWith(progress, requestId, toolName, args) {
     return finish(env, extra);
   }
 
+  if (toolName === 'feedback_wait') {
+    const { env, extra } = await feedbackWait(requestId, traceId, args, progress);
+    return finish(env, extra);
+  }
+
   if (LOCAL_TOOLS.has(toolName)) return finish(await workflowTool(requestId, traceId, toolName, args, progress));
   // A background run is driving this session's tab: reading is fine, acting would interleave with its steps.
   const running = backgroundRuns.active();
@@ -713,9 +744,9 @@ const FEEDBACK_INLINE_IMAGES = 12;
 const FEEDBACK_INLINE_BYTES = 6 * 1024 * 1024;
 const MIME_BY_EXT = { png: 'image/png', jpg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif' };
 
-function feedbackTool(traceId, toolName, args) {
+function feedbackTool(traceId, toolName, args, options = {}) {
   if (toolName === 'feedback_list') {
-    const batches = feedback.list({ includeDelivered: args.includeDelivered === true });
+    const batches = feedback.list({ includeDelivered: args.includeDelivered === true, session: SESSION_ID });
     const pending = batches.filter((b) => !b.delivered).length;
     return {
       env: okEnvelope(traceId, batches.length
@@ -724,7 +755,7 @@ function feedbackTool(traceId, toolName, args) {
       extra: [],
     };
   }
-  const batch = feedback.get(args.id);
+  const batch = feedback.get(args.id, { session: SESSION_ID, oldest: options.oldest === true });
   if (!batch) {
     return {
       env: args.id
@@ -734,6 +765,8 @@ function feedbackTool(traceId, toolName, args) {
     };
   }
   if (args.markDelivered !== false) feedback.markDelivered(batch.id);
+  // Whoever read it answers in the tab it was written from (a reply with no tab would show in no panel at all).
+  if (Number.isInteger(batch.tabId)) updateChatTab(batch.tabId);
   const extra = [];
   let bytes = 0;
   if (args.images !== false) {
@@ -755,13 +788,53 @@ function feedbackTool(traceId, toolName, args) {
   const pinned = batch.comments.length - messages;
   const what = [messages ? `${messages} message(s)` : '', pinned ? `${pinned} comment(s)` : ''].filter(Boolean).join(' and ');
   const where = pages.length === 0 ? '' : ` on ${pages.length === 1 ? pages[0] : `${pages.length} pages`}`;
-  return {
-    env: okEnvelope(traceId,
-      `${what} from the person${where}.`,
-      { batch },
-      {}),
-    extra,
-  };
+  const env = okEnvelope(traceId, `${what} from the person${where}.`, { batch }, {});
+  // The person reads the side panel, not the agent's terminal: an answer written anywhere else never reaches them.
+  if (messages) {
+    env.nextAction = 'The person is waiting in the BrowserZap side panel: put your answer there with chat_reply (Markdown is '
+      + 'shown). Text you write in your own chat is not shown to them.';
+  }
+  return { env, extra };
+}
+
+/**
+ * feedback_wait, the chat listener: returns the person's next message or note batch for this session (oldest
+ * first, like feedback_get), or says nothing came within waitMs. A bounded poll of the local folder; the panel
+ * shows "listening" meanwhile; a cancelled request stops at once.
+ */
+async function feedbackWait(requestId, traceId, args, progress) {
+  const waitMs = Math.min(Math.max(Number.isInteger(args.waitMs) ? args.waitMs : FEEDBACK_WAIT_DEFAULT_MS, 1000), FEEDBACK_WAIT_MAX_MS);
+  const deadline = Date.now() + waitMs;
+  let cancelled = false;
+  let wake = null;
+  inflightByRequest.set(requestId, { cancel() { cancelled = true; wake?.(); } });
+  const nudge = () => wake?.();
+  feedbackWaiters.add(nudge);
+  updateListening(true);
+  progress.heartbeat(() => 'Listening for the person in the BrowserZap side panel');
+  try {
+    while (!cancelled) {
+      if (feedback.pendingCount({ session: SESSION_ID }) > 0) {
+        return feedbackTool(traceId, 'feedback_get', { images: args.images }, { oldest: true });
+      }
+      const left = deadline - Date.now();
+      if (left <= 0) break;
+      await new Promise((resolve) => {
+        wake = resolve;
+        setTimeout(resolve, Math.min(FEEDBACK_POLL_MS, left));
+      });
+    }
+    const seconds = Math.round(waitMs / 1000);
+    const env = okEnvelope(traceId,
+      cancelled ? 'Stopped listening.' : `No message from the person in ${seconds} s.`,
+      { batch: null, timedOut: !cancelled });
+    if (!cancelled) env.nextAction = 'Call feedback_wait again to keep listening, or stop when the person is done.';
+    return { env, extra: [] };
+  } finally {
+    inflightByRequest.delete(requestId);
+    feedbackWaiters.delete(nudge);
+    updateListening(false);
+  }
 }
 
 // ─── Workflows and plan (docs/WORKFLOWS.md, docs/PRO.md) ─────────────────────
@@ -1219,7 +1292,7 @@ async function statusTool(traceId, args) {
     env.evidence = { ...evidence, extension: 'connected' };
     const notice = extensionVersionNotice(evidence.extensionVersion);
     if (notice) env.notice = notice;
-    const waiting = feedback.pendingCount();
+    const waiting = feedback.pendingCount({ session: SESSION_ID });
     if (waiting && typeof env.summary === 'string') {
       env.summary = `${env.summary} ${unreadFeedbackNote(waiting)}`;
     }
@@ -1286,7 +1359,9 @@ async function handleRequest(request) {
           'browser_new_tab only for a side trip (research, a comparison) and close it with browser_close_tab when done, ' +
           'which takes you back to the main tab. A session keeps at most 3 tabs between tasks; its tabs close when it ends. ' +
           'When the user mentions their BrowserZap feedback or comments, call feedback_get: it returns the notes they ' +
-          'made on page elements in Comment mode, with components, source files and screenshots. When debugging a page, ' +
+          'made on page elements in Comment mode, with components, source files and screenshots. The user can also type ' +
+          'to you in the side panel: answer with chat_reply. When they ask you to listen to them in BrowserZap, call ' +
+          'feedback_wait, act or answer, and call it again until they are done. When debugging a page, ' +
           'page_console and page_network show what it logged and requested. A click that downloads a file says so; ' +
           'browser_downloads lists and waits for downloads. file_upload always needs the user\'s approval per file.',
       });

package/bridge-server/panel.js

@@ -73,9 +73,10 @@ function writeLastRuns(runs) {
  * @param {object} io
  * @param {(msg: object, socket: object, profile: string) => boolean} io.deliver  send an action for the panel session to that profile; false if it is not connected
  * @param {(msg: object, profile: string) => void} io.toExtension                  send a panel_event / cancel to that profile's extension
+ * @param {(session: string | null) => void} [io.onFeedback]                       a batch was saved for this session (null: any)
  * @param {(event: string, fields?: object) => void} [io.log]
  */
-function createPanelRunner({ deliver, toExtension, log = () => {} }) {
+function createPanelRunner({ deliver, toExtension, isSessionLive = () => true, onFeedback = () => {}, log = () => {} }) {
   const service = createWorkflowService({ log });
   const sessionLog = createSessionLog({ session: PANEL_SESSION, client: () => 'side panel' });
   let current = null;
@@ -438,9 +439,14 @@ function createPanelRunner({ deliver, toExtension, log = () => {} }) {
           return { ok: true, data: {} };
         case 'feedback_submit': {
           // Comment mode (docs/COMMENT_MODE.md): stored on this device for the agent's feedback_get.
-          const saved = feedback.saveBatch(args.batch);
-          log('feedback_saved', { batch: saved.id, comments: saved.count });
-          return { ok: true, data: { batchId: saved.id, count: saved.count } };
+          // Addressed to an agent that has gone? Then "any agent" (session null), never an id nobody can read.
+          const asked = args.batch && typeof args.batch.session === 'string' ? args.batch.session : null;
+          const live = asked ? isSessionLive(asked) : false;
+          const saved = feedback.saveBatch(live ? args.batch : { ...args.batch, session: null });
+          log('feedback_saved', { batch: saved.id, comments: saved.count, live });
+          // Wake a waiting feedback_wait now instead of on its next poll.
+          onFeedback(live ? asked : null);
+          return { ok: true, data: { batchId: saved.id, count: saved.count, session: live ? asked : null, live } };
         }
         default:
           return { ok: false, error: { code: 'INVALID_ARGUMENT', message: `Unknown panel request "${op}".` } };

package/bridge-server/profile-labels.js

@@ -0,0 +1,81 @@
+'use strict';
+
+/**
+ * Stable names for connected browser profiles, kept per extension install id.
+ *
+ * An unnamed profile gets "Profile N" once and keeps it across reconnects and bridge restarts; the number is
+ * never handed to another install. A rename changes only that install. Names live in `profiles.json` in the
+ * config folder (no page data, only id → label). Without a file (tests) they live in memory.
+ */
+
+const fs = require('fs');
+
+const MAX_ENTRIES = 50;
+
+function createProfileLabels(file = null) {
+  /** @type {Record<string, { label: string, custom: boolean, number?: number, seen: number }>} */
+  let entries = {};
+  if (file) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) entries = parsed;
+    } catch {
+      /* first run or unreadable: start empty */
+    }
+  }
+
+  function save() {
+    const ids = Object.keys(entries);
+    if (ids.length > MAX_ENTRIES) {
+      ids.sort((a, b) => entries[a].seen - entries[b].seen).slice(0, ids.length - MAX_ENTRIES).forEach((id) => delete entries[id]);
+    }
+    if (!file) return;
+    try {
+      fs.writeFileSync(file, JSON.stringify(entries, null, 2), { mode: 0o600 });
+    } catch {
+      /* names still work for this run */
+    }
+  }
+
+  function nextNumber() {
+    let max = 0;
+    for (const entry of Object.values(entries)) if (typeof entry.number === 'number' && entry.number > max) max = entry.number;
+    return max + 1;
+  }
+
+  return {
+    /** The name for an install that just connected: what it sent, else what it had, else a new "Profile N". */
+    connect(id, sentLabel) {
+      const entry = entries[id];
+      if (sentLabel) {
+        // A named install takes no number: "Profile N" counts unnamed ones. It keeps one it already had.
+        entries[id] = { ...entry, label: sentLabel, custom: true, seen: Date.now() };
+      } else if (entry) {
+        entry.seen = Date.now();
+      } else {
+        const number = nextNumber();
+        entries[id] = { label: `Profile ${number}`, custom: false, number, seen: Date.now() };
+      }
+      save();
+      return entries[id].label;
+    },
+    /** The person renamed this install; no other entry changes. */
+    rename(id, label) {
+      entries[id] = { ...entries[id], label, custom: true, seen: Date.now() };
+      save();
+      return label;
+    },
+    /** The person cleared the name: back to this install's own "Profile N". */
+    reset(id) {
+      const number = entries[id]?.number ?? nextNumber();
+      entries[id] = { label: `Profile ${number}`, custom: false, number, seen: Date.now() };
+      save();
+      return entries[id].label;
+    },
+    get(id) {
+      return entries[id]?.label ?? null;
+    },
+  };
+}
+
+module.exports = { createProfileLabels };

package/bridge-server/resolvers.js

@@ -12,7 +12,7 @@ const { LIMITS } = require('./limits');
  * step — so every wait and every retry still goes through the normal tool path
  * and extension policy.
  *
- * Design: docs/NEXT_RELEASE_SCOPE_0.6.md (§3 of the 0.5 doc);
+ * Design: docs/archive/NEXT_RELEASE_SCOPE_0.6.md (§3 of the 0.5 doc);
  * the wait kinds it relies on: docs/ADR/ADR-007-waiting-and-timeouts.md.
  *
  * Adding a resolver is one entry here plus a fixture that fails without it.

package/bridge-server/secret.js

@@ -3,7 +3,7 @@
  *
  * The bridge WebSocket is the only network listener in the system. Upstream
  * shipped it bound to 0.0.0.0 with no authentication at all (finding SEC-01 in
- * docs/REPOSITORY_AUDIT.md), which let any local or LAN process drive the
+ * docs/archive/REPOSITORY_AUDIT.md), which let any local or LAN process drive the
  * user's logged-in browser.
  *
  * BrowserZap closes that by requiring a shared secret on the first frame of every

package/bridge-server/server.js

@@ -9,7 +9,7 @@
  *
  * Derived from Open Browser Control (MIT, Copyright (c) 2026 smankoo) at commit
  * 4e6c262. Changes from upstream are marked "// BROWSERZAP:" and are summarised in
- * docs/PHASE_1_REPORT.md:
+ * docs/archive/PHASE_1_REPORT.md:
  *
  *   - the listener binds 127.0.0.1 only and refuses to run otherwise (SEC-01)
  *   - every connection must authenticate with the per-install secret before it
@@ -36,6 +36,8 @@ const { getOrCreateSecret, secretMatches, secretPath, configDir } = require('./s
 const pairing = require('./pairing');
 const { version: BRIDGE_VERSION } = require('../package.json');
 const { createPanelRunner } = require('./panel');
+const feedback = require('./feedback');
+const { createProfileLabels } = require('./profile-labels');
 const { LIMITS } = require('./limits');
 
 // ─── Constants ───────────────────────────────────────────────────────────────
@@ -71,7 +73,7 @@ const MAX_EXTENSION_MESSAGES_PER_SECOND = 500;
 // execution in the page is not part of this product.
 // Must match AGENT_ACTIONS in src/types/protocol.ts (tests/contract.test.mjs).
 const VALID_AGENT_ACTIONS = new Set([
-  'status', 'inspect', 'navigate', 'click', 'fill', 'select_option', 'wait_for',
+  'status', 'inspect', 'navigate', 'click', 'hover', 'fill', 'select_option', 'wait_for',
   'screenshot', 'press_key', 'scroll', 'pause', 'resume',
   'new_tab', 'list_tabs', 'switch_tab', 'close_tab', 'notify', 'upload',
   'console', 'network', 'say',
@@ -108,6 +110,7 @@ function isValidMessage(msg) {
   }
   if (msg.type === 'cancel' && (typeof msg.id !== 'string' || !msg.id)) return false;
   if (msg.type === 'session_start' && typeof msg.name !== 'string') return false;
+  if (msg.type === 'session_update' && typeof msg.name !== 'string' && typeof msg.listening !== 'boolean' && !Number.isInteger(msg.chatTabId)) return false;
   return true;
 }
 
@@ -137,10 +140,13 @@ function isLoopbackAddress(address) {
  *                                  decision, not a convenience.
  * @param {string} [options.secret] Expected pairing secret. Defaults to the on-disk secret.
  * @param {(msg: string) => void} [options.log]
+ * @param {object} [options.limits] Test seam only: timer values to use instead of `limits.js`. The E2E
+ *                                  harness shortens the session grace period; no shipped build passes this.
  */
 function createBridgeServer(options = {}) {
   const port = options.port ?? DEFAULT_PORT;
   const host = options.host ?? BIND_HOST;
+  const limits = options.limits ?? LIMITS;
   const expectedSecret = options.secret ?? getOrCreateSecret();
   const log = options.log ?? ((msg) => process.stderr.write(`[browserzap-bridge] ${msg}\n`));
 
@@ -159,12 +165,19 @@ function createBridgeServer(options = {}) {
    * once (multi-profile, docs/MULTI_PROFILE.md). The same install reconnecting
    * replaces its own socket. `extensionVersion` is what the extension reported
    * in its hello (WP5); null when it is older and reports nothing.
-   * @type {Map<string, { ws: WebSocket, browser: string, label: string, connectedAt: number, extensionVersion: string | null }>}
+   * `extensionId` is the Chrome extension id: two different ids connected at
+   * once mean two different builds (store + developer), not one profile each (B-05).
+   * @type {Map<string, { ws: WebSocket, browser: string, label: string, connectedAt: number, extensionVersion: string | null, extensionId: string | null }>}
    */
   const profiles = new Map();
   /** @type {Map<WebSocket, string>} */
   const socketToProfile = new Map();
   let anonymousProfiles = 0;
+  // Names per install id, kept on disk so a restart never renumbers profiles (B-05, 0.8 public).
+  // Tests that pass their own secret keep names in memory unless they name a file.
+  const labels = createProfileLabels(options.profileLabelsFile !== undefined
+    ? options.profileLabelsFile
+    : (options.secret ? null : path.join(configDir(), 'profiles.json')));
 
   /**
    * Agent sessions. `profile` is the browser profile the session acts in: set
@@ -184,10 +197,21 @@ function createBridgeServer(options = {}) {
   };
   const profileList = (selected) => [...profiles.entries()].map(([id, p]) => ({
     id, label: p.label, browser: p.browser, connectedAt: new Date(p.connectedAt).toISOString(), selected: id === selected,
-    // What the store build said in its hello; null for a build older than 0.7.0.
+    // What the build said in its hello; null for a build older than 0.7.0 / 0.8.0.
     extensionVersion: p.extensionVersion ?? null,
+    extensionId: p.extensionId ?? null,
   }));
 
+  /**
+   * The extension view of the connected profiles, sent on every change so each
+   * side panel can warn when two different builds run at once (B-05). An older
+   * extension ignores the event, which is why it is additive.
+   */
+  function broadcastProfiles() {
+    const data = { profiles: profileList(null) };
+    for (const p of profiles.values()) safeSend(p.ws, { type: 'event', event: 'profiles', data });
+  }
+
   // The side panel's workflow runner: a built-in session that drives the
   // extension like an agent would, so every step gets the same checks. A run
   // acts in the profile whose side panel started it.
@@ -199,6 +223,19 @@ function createBridgeServer(options = {}) {
       return true;
     },
     toExtension: (msg, profile) => sendTo(profileSocket(profile), msg),
+    // Whether a named session still has a live socket: a message addressed to an agent that has gone is stored
+    // as "any agent" instead of being unreadable for ever (feedback.releaseOrphans).
+    isSessionLive: (id) => {
+      const session = agentSessions.get(id);
+      return Boolean(session && (session.builtIn || session.ws));
+    },
+    // A message was stored: tell the agent it is for (or every agent, when unaddressed) so a feedback_wait returns at
+    // once. Only a nudge; the agent still reads the batch from the folder, and an older MCP server ignores the event.
+    onFeedback: (session) => {
+      for (const [id, s] of agentSessions) {
+        if (!s.builtIn && s.ws && (!session || id === session)) safeSend(s.ws, { type: 'event', event: 'feedback_new' });
+      }
+    },
     log: (event, fields) => log(`panel ${event}${fields ? ` ${JSON.stringify(fields)}` : ''}`),
   });
   if (panel) agentSessions.set(panel.session, { ws: panel.socket, name: panel.sessionName, profile: null, builtIn: true });
@@ -434,9 +471,11 @@ function createBridgeServer(options = {}) {
         if (msg.type === 'profile_update') {
           const label = sanitizeSessionName(msg.label);
           const p = profiles.get(fromProfile);
-          if (p && label) {
-            p.label = label;
-            log(`Profile renamed to "${label}"`);
+          if (p) {
+            // An empty name gives this install back its own "Profile N"; no other profile changes.
+            p.label = label ? labels.rename(fromProfile, label) : labels.reset(fromProfile);
+            log(`Profile renamed to "${p.label}"`);
+            broadcastProfiles();
           }
           return;
         }
@@ -470,13 +509,19 @@ function createBridgeServer(options = {}) {
       if (msg.type === 'session_update') {
         const session = agentSessions.get(sessionId);
         const name = sanitizeSessionName(msg.name);
-        if (session && name) {
+        const listening = typeof msg.listening === 'boolean' ? msg.listening : undefined;
+        // The tab a reply belongs to when the agent read a message from a tab no session owned (updateChatTab).
+        const chatTabId = Number.isInteger(msg.chatTabId) && msg.chatTabId >= 0 ? msg.chatTabId : undefined;
+        if (!session || (!name && listening === undefined && chatTabId === undefined)) return;
+        if (name) {
           session.name = name;
-          msg.name = name;
           log(`Agent "${session.name}" renamed (session: ${sessionId})`);
-        } else {
-          return;
         }
+        // Only these fields reach the extension.
+        for (const key of Object.keys(msg)) if (!['type', 'session'].includes(key)) delete msg[key];
+        if (name) msg.name = name;
+        if (listening !== undefined) msg.listening = listening;
+        if (chatTabId !== undefined) msg.chatTabId = chatTabId;
       }
       // The bridge, not the agent, decides which session a message belongs to.
       msg.session = sessionId;
@@ -527,6 +572,7 @@ function createBridgeServer(options = {}) {
         if (profiles.get(profileId)?.ws === ws) {
           log(`Browser profile "${profiles.get(profileId).label}" disconnected`);
           profiles.delete(profileId);
+          broadcastProfiles();
         }
         return;
       }
@@ -538,11 +584,11 @@ function createBridgeServer(options = {}) {
         // The connection dropped without a goodbye: the agent may come back with
         // the same session id (a restart, a blip), so its tabs wait
         // SESSION_GRACE_MS before the session ends (D-38).
-        log(`Agent "${session.name}" disconnected (session: ${sessionId}); ending it in ${LIMITS.SESSION_GRACE_MS / 1000} s unless it reconnects`);
+        log(`Agent "${session.name}" disconnected (session: ${sessionId}); ending it in ${limits.SESSION_GRACE_MS / 1000} s unless it reconnects`);
         session.ws = null;
         session.graceTimer = setTimeout(() => {
           if (agentSessions.get(sessionId) === session && !session.ws) endAgentSession(sessionId);
-        }, LIMITS.SESSION_GRACE_MS);
+        }, limits.SESSION_GRACE_MS);
       }
     });
 
@@ -559,17 +605,27 @@ function createBridgeServer(options = {}) {
     // is accepted as it always was. A reconnect that omits it keeps the version
     // this profile reported before.
     const extensionVersion = typeof hello.extensionVersion === 'string' && hello.extensionVersion ? hello.extensionVersion.slice(0, 32) : null;
+    // Which build this is. Additive: a pre-0.8 extension sends nothing.
+    const extensionId = typeof hello.extensionId === 'string' && /^[a-p]{32}$/.test(hello.extensionId) ? hello.extensionId : null;
     const existing = profiles.get(id);
     if (existing && existing.ws !== ws && existing.ws.readyState === WebSocket.OPEN) {
       log('Browser profile reconnected (replacing old connection)');
       existing.ws.close(CLOSE_REPLACED, 'Replaced by new extension connection');
     }
-    const label = sanitizeSessionName(hello.label) ?? existing?.label ?? `Profile ${profiles.size + (existing ? 0 : 1)}`;
-    profiles.set(id, { ws, browser, label, connectedAt: Date.now(), extensionVersion: extensionVersion ?? existing?.extensionVersion ?? null });
+    const label = labels.connect(id, sanitizeSessionName(hello.label));
+    profiles.set(id, {
+      ws, browser, label, connectedAt: Date.now(),
+      extensionVersion: extensionVersion ?? existing?.extensionVersion ?? null,
+      extensionId: extensionId ?? existing?.extensionId ?? null,
+    });
     socketToProfile.set(ws, id);
     log(`Browser profile "${label}" connected (${browser}, ${id.slice(0, 8)}); ${profiles.size} connected`);
 
-    safeSend(ws, { type: 'event', event: 'connected', data: { protocolVersion: PROTOCOL_VERSION, profile: { id, label }, profiles: profiles.size } });
+    safeSend(ws, {
+      type: 'event', event: 'connected',
+      data: { protocolVersion: PROTOCOL_VERSION, profile: { id, label }, profiles: profiles.size, profilesList: profileList(id) },
+    });
+    broadcastProfiles();
 
     // The built-in panel session exists in every profile; agent sessions only in the one they act in.
     for (const [sessionId, session] of agentSessions) {
@@ -588,6 +644,9 @@ function createBridgeServer(options = {}) {
     agentSessions.delete(sessionId);
     if (session.ws) socketToSession.delete(session.ws);
     log(`Agent "${session.name}" ended (session: ${sessionId})`);
+    // Anything the person sent to this agent and it never read is given back to "any agent" (feedback.releaseOrphans).
+    const released = feedback.releaseOrphans({ session: sessionId, liveSessionIds: new Set(agentSessions.keys()) });
+    if (released) log(`Released ${released} unread message(s) from "${session.name}"`);
     sendTo(profileSocket(session.profile), { type: 'session_end', session: sessionId });
   }
 
@@ -628,6 +687,15 @@ function createBridgeServer(options = {}) {
 
   // ─── Lifecycle ─────────────────────────────────────────────────────────────
 
+  // A killed bridge leaves messages addressed to sessions that no longer exist. No agent is live at start, so
+  // every undelivered stamp is released and the next agent to ask can read it (feedback.releaseOrphans).
+  try {
+    const swept = feedback.releaseOrphans({ liveSessionIds: new Set() });
+    if (swept) log(`Released ${swept} unread message(s) left by a previous run`);
+  } catch (err) {
+    log(`Could not release old messages: ${err.message}`);
+  }
+
   // Resolves once the listener is bound (or fails), so callers/tests do not race.
   const ready = new Promise((resolve, reject) => {
     wss.once('listening', () => {

package/bridge-server/setup.js

@@ -621,7 +621,7 @@ async function setupCommand(args = [], { extensionPath = null, dir = configDir()
     write('  Warning: this copy runs from the npx cache, which npm may clear; Chrome and your agent would then');
     write('  lose BrowserZap. Install it once with `npm install -g browserzap`, then run `browserzap setup`.');
   }
-  write(`  Extension id: ${EXTENSION_ID}`);
+  write(`  Extension id${dev ? 's' : ''}: ${dev ? `${STORE_EXTENSION_ID} (store), ${EXTENSION_ID} (developer build)` : STORE_EXTENSION_ID}`);
   write(`  Extension mode: ${dev ? 'store + developer build (setup --dev)' : 'store only'}`);
   write(`  Host manifest: ${result.manifestPaths[0]}`);
   write(`  Launcher:      ${result.launcher}`);

package/bridge-server/tools.js

@@ -171,12 +171,31 @@ const MCP_TOOLS = [
       },
     },
   },
+  {
+    name: 'element_hover',
+    description:
+      'Move the pointer over exactly one element and report what appeared (a menu, tooltip, or controls a row reveals ' +
+      'on hover). Resolves the target like element_click and refuses ambiguous, hidden or covered targets. Read-only: ' +
+      'no approval. Follow with element_click on what appeared.',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      required: ['target'],
+      properties: {
+        target: TARGET,
+        timeoutMs: ACTION_TIMEOUT,
+      },
+    },
+  },
   {
     name: 'field_fill',
     description:
       'Replace the content of one text field (or set a checkbox/radio with "true"/"false") and verify it. ' +
-      'Sensitive fields (passwords, one-time codes, card numbers, government IDs) are refused with ' +
-      'USER_ACTION_REQUIRED — ask the user to type those. The value is never logged or echoed back.',
+      'Text is typed through Chrome\'s trusted input channel at the caret, so key listeners fire and rich editors ' +
+      '(Medium, Gmail, LinkedIn, Slack) accept it. A multi-block rich editor is never cleared: the text is appended ' +
+      'at the end of its last block and the result says mode "append". Sensitive fields (passwords, one-time codes, ' +
+      'card numbers, government IDs) are refused with USER_ACTION_REQUIRED — ask the user to type those. The value is ' +
+      'never logged or echoed back.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -248,16 +267,18 @@ const MCP_TOOLS = [
   {
     name: 'browser_press_key',
     description:
-      'Press one key on the focused element. Enter inside a form counts as submitting it and follows the same ' +
-      'approval rules as element_click.',
+      'Press one key on the focused element: a named key (Enter, Tab, Escape, Backspace, Delete, the arrows, Home, ' +
+      'End, PageUp, PageDown, Space), one printable character, or either with modifiers joined by "+" — ctrl+b, ' +
+      'ctrl+k, ctrl+a, ctrl+alt+1, ctrl+enter, meta+shift+t. Enter (with or without modifiers) inside a form counts ' +
+      'as submitting it and follows the same approval rules as element_click.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
       required: ['key'],
       properties: {
         key: {
-          type: 'string',
-          enum: ['Enter', 'Tab', 'Escape', 'Backspace', 'Delete', 'ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight', 'Home', 'End', 'PageUp', 'PageDown', 'Space'],
+          type: 'string', minLength: 1, maxLength: 32,
+          description: 'A named key, one printable character, or a chord: ctrl+b, ctrl+enter, ctrl+alt+1.',
         },
         modifiers: { type: 'array', maxItems: 4, items: { type: 'string', enum: ['ctrl', 'alt', 'shift', 'meta'] } },
         approvalId: { type: 'string', maxLength: 64 },
@@ -542,6 +563,22 @@ const MCP_TOOLS = [
       },
     },
   },
+  {
+    name: 'feedback_wait',
+    description:
+      'Listen for the person: wait until they send a message or notes from the BrowserZap side panel, then return it ' +
+      'exactly like feedback_get (oldest first, marked delivered). Waits up to waitMs (default 60000, at most 300000) ' +
+      'and says so if nothing came; the panel shows that you are listening meanwhile. Use it when the person asks you ' +
+      'to listen to them in BrowserZap: wait, act or answer with chat_reply, then call feedback_wait again.',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        waitMs: { type: 'integer', minimum: 1000, maximum: 300000 },
+        images: { type: 'boolean', description: 'Include the screenshots inline (default true).' },
+      },
+    },
+  },
   {
     name: 'page_console',
     description:
@@ -687,6 +724,7 @@ const ANNOTATIONS = {
   page_inspect: ['Inspect page', READ],
   browser_navigate: ['Navigate', { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }],
   element_click: ['Click element', { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
+  element_hover: ['Hover element', READ],
   field_fill: ['Fill field', { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }],
   select_option: ['Select option', { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }],
   wait_for_state: ['Wait for page state', READ],
@@ -709,6 +747,7 @@ const ANNOTATIONS = {
   file_upload: ['Attach a file', { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
   feedback_list: ['List page comments', LOCAL_READ],
   feedback_get: ['Read page comments', { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }],
+  feedback_wait: ['Listen for the person', { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }],
   page_console: ['Read console', READ],
   page_network: ['Read network requests', READ],
   workflow_list: ['List workflows', LOCAL_READ],
@@ -728,7 +767,7 @@ for (const tool of MCP_TOOLS) {
 /** Tools handled entirely in the MCP server (no extension action). */
 const LOCAL_TOOLS = new Set([
   'browser_set_session_name', 'browser_list_profiles', 'browser_select_profile',
-  'feedback_list', 'feedback_get', 'browser_downloads',
+  'feedback_list', 'feedback_get', 'feedback_wait', 'browser_downloads',
   'workflow_record', 'workflow_save', 'workflow_list', 'workflow_get', 'workflow_run',
   'workflow_delete', 'workflow_history', 'workflow_reports', 'workflow_status',
 ]);
@@ -739,6 +778,7 @@ const TOOL_TO_ACTION = {
   page_inspect: 'inspect',
   browser_navigate: 'navigate',
   element_click: 'click',
+  element_hover: 'hover',
   field_fill: 'fill',
   select_option: 'select_option',
   wait_for_state: 'wait_for',
@@ -765,7 +805,7 @@ const INTERNAL_ACTIONS = new Set(['notify']);
 
 /** Tools that act on page content and therefore carry the origin allowlist. */
 const PAGE_TOOLS = new Set([
-  'page_inspect', 'browser_navigate', 'element_click', 'field_fill', 'select_option',
+  'page_inspect', 'browser_navigate', 'element_click', 'element_hover', 'field_fill', 'select_option',
   'wait_for_state', 'screenshot_capture', 'browser_press_key', 'browser_scroll',
 ]);
 
@@ -830,11 +870,11 @@ function validateArguments(tool, args) {
 }
 
 /**
- * Tools held back for internal testing (0.8). They are offered only when
- * BROWSERZAP_EXPERIMENTAL lists their feature, e.g. BROWSERZAP_EXPERIMENTAL=chat.
- * A hidden tool is also refused if called (mcp-server.js looks tools up here).
+ * Tools held back for internal testing. They are offered only when BROWSERZAP_EXPERIMENTAL lists their feature,
+ * e.g. BROWSERZAP_EXPERIMENTAL=chat. A hidden tool is also refused if called (mcp-server.js looks tools up here).
+ * Empty since 0.8.0: chat_reply and feedback_wait ship (docs/DECISIONS.md D-0.8-2).
  */
-const EXPERIMENTAL_TOOLS = Object.freeze({ chat_reply: 'chat' });
+const EXPERIMENTAL_TOOLS = Object.freeze({});
 const enabledExperiments = new Set(String(process.env.BROWSERZAP_EXPERIMENTAL ?? '').split(',').map((s) => s.trim()).filter(Boolean));
 for (let i = MCP_TOOLS.length - 1; i >= 0; i--) {
   const feature = EXPERIMENTAL_TOOLS[MCP_TOOLS[i].name];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browserzap",
-  "version": "0.7.0",
+  "version": "0.8.5",
   "description": "Let your AI agent (Claude Code, Codex, Cursor or any MCP client) work in your own Chrome, with your logins, your approval and a Stop button.",
   "homepage": "https://browserzap.com",
   "bugs": {
@@ -42,6 +42,7 @@
   },
   "scripts": {
     "build": "node scripts/clean.mjs --dist-only && webpack --mode production && npm run build:css && npm run package:extension",
+    "build:e2e": "webpack --mode production --env e2e && npm run build:css:e2e && node scripts/package-extension.mjs --from dist/chrome-e2e --dest extension-e2e",
     "dev": "webpack --mode development --watch",
     "clean": "node scripts/clean.mjs",
     "package:extension": "node scripts/package-extension.mjs",
@@ -56,13 +57,16 @@
     "license:scan": "node scripts/license-scan.mjs",
     "verify": "npm run lint && npm run typecheck && npm run test",
     "release:check": "node scripts/release-check.mjs",
-    "test:e2e": "node scripts/run-tests.mjs tests/e2e .e2e.mjs --test-concurrency=1",
+    "test:e2e": "node scripts/run-tests.mjs tests/e2e .e2e.mjs --test-concurrency=1 --e2e-limits",
+    "test:e2e:fast": "node scripts/run-tests.mjs tests/e2e .e2e.mjs --test-concurrency=1 --e2e-limits --fast",
+    "test:e2e:real-timers": "node scripts/run-tests.mjs tests/e2e .e2e.mjs --test-concurrency=1 --real-timers",
     "config": "node scripts/mcp-config.mjs",
     "test:clients": "node tests/e2e/clients.mjs",
     "benchmark": "node tests/e2e/benchmark.mjs",
     "demo": "node tests/e2e/demo.mjs",
     "compare:duplicates": "node tests/e2e/duplicates.mjs",
     "build:css": "tailwindcss -i src/sidepanel/sidepanel.css -o dist/chrome/sidepanel.css --minify",
+    "build:css:e2e": "tailwindcss -i src/sidepanel/sidepanel.css -o dist/chrome-e2e/sidepanel.css --minify",
     "dev:css": "tailwindcss -i src/sidepanel/sidepanel.css -o dist/chrome/sidepanel.css --watch",
     "logs": "node bridge-server/index.js --logs",
     "runs": "node bridge-server/index.js --runs",
@@ -71,8 +75,13 @@
     "build:reports": "node scripts/build-reports.mjs",
     "build:brand": "node scripts/build-brand.mjs",
     "build:site": "npm --prefix web run build",
-    "deploy:site": "npm --prefix web run build && wrangler pages deploy web/out --project-name browserzap --branch main",
-    "bridge:restart": "node scripts/bridge-restart.mjs"
+    "deploy:site": "npm --prefix web run deploy",
+    "bridge:restart": "node scripts/bridge-restart.mjs",
+    "site:data": "npm --prefix web run data --",
+    "test:e2e:rerun-failed": "node scripts/run-tests.mjs tests/e2e .e2e.mjs --test-concurrency=1 --e2e-limits --rerun-failures",
+    "release:changes": "node scripts/changes-since.mjs",
+    "release:public": "node scripts/release-public.mjs",
+    "release:internal": "node scripts/release-internal.mjs"
   },
   "devDependencies": {
     "@fontsource-variable/inter": "5.3.0",
@@ -80,15 +89,17 @@
     "@resvg/resvg-js": "2.6.2",
     "@tailwindcss/cli": "4.3.0",
     "@types/chrome": "^0.1.38",
+    "axe-core": "^4.10.2",
     "copy-webpack-plugin": "^14.0.0",
     "css-loader": "^7.1.2",
+    "lucide-preact": "^1.66.0",
+    "preact": "^10.29.8",
     "style-loader": "^4.0.0",
     "tailwindcss": "4.3.0",
     "ts-loader": "^9.5.1",
     "typescript": "^5.6.3",
     "webpack": "^5.96.1",
-    "webpack-cli": "^5.1.4",
-    "preact": "^10.29.8"
+    "webpack-cli": "^5.1.4"
   },
   "dependencies": {
     "ws": "^8.22.0"