What changed, and when

• Codex: runs start again on current Codex releases. Codex stopped accepting the flags Browsentic used to keep it read-only, so every run ended with "Your Codex does not understand the flags Browsentic uses", and a follow-up message in the same conversation failed the same way. The read-only sandbox is unchanged (98b5220)
• Codex: browser actions are no longer refused with "blocked by the approval policy". Browsentic's own tools are approved for the run, and each one still passes through Browsentic's approval prompt and guardrails (856fd2d)
• Codex: the model picker offers the models Codex has now (gpt-5.6-terra, gpt-5.6-luna, gpt-5.5) and the effort levels it accepts (low to xhigh). A model your account cannot use now says so in a sentence and tells you to pick another in the popup (768de4c)
• Screenshots: a screenshot captures the tab the run is working in, not whichever tab is in front (00096b3)
• macOS: the DMG is notarized when Apple credentials are present, and the instructions for opening an unnotarized copy are correct (e9907a7)

• macOS: install the app with the one-line script, with the disk image as the fallback. The installer clears the quarantine flag itself (5e7d4d6, 473bf2e)

• mac: preflight screen and the seven-tab control panel in Ember and Daylight (8db6231)
• mac: native control client, Node runtime installer and payload installer (d8474df)
• cli: add start, agent model, and --json on agent, skills, approvals and downloads (779fe3a)
• cli: recognise an install laid down by the macOS app and leave its updates to the app (c0e0495)

• readme: quick start first with the macOS install, security and contributing as links (83a3b40)
• the macOS app guide, its internals page, and the new CLI commands (6318244)
• put the side panel before the MCP server on every entry surface (3b5d3fb)

• frames: step into an iframe and let every page tool, site tool and live tool follow (7dde448)

• readme: call it a completely integrated agentic browser extension (3a93351)

page.startMonitor watches a tab in the background: an upload reaching 100%, a build log announcing success: and until now it announced the result with an OS notification. That is a banner that is gone in seconds, and on a busy desktop it is easy to miss entirely.

A finished watch now draws a card into the page in front of you instead: the active tab of the focused window, falling back to the window that owns the watched tab. Click it and you land on the tab that finished, window focused and all.

• It follows your theme, and lives in a closed shadow root: the page can neither style nor read it, and page.extractText never picks it up.
• Ten seconds on screen, with a draining bar. The countdown does not start until the document is actually visible, so a minimized window does not burn it unseen.
• Up to three stack at once, each with a dismiss button.
• A monitor you stopped yourself stays silent, as before.

The OS notification is now the fallback rather than the announcement. It fires only when no page will take a card, every tab a chrome:// page, or a window with nothing open, so you still hear about it, and nothing ever notifies twice.

No new permissions.

browsentic uninstall: one command for the whole sweep (4517fda)

npx browsentic uninstall

It prints exactly what it will remove and asks before removing any of it: the daemon, ~/.browsentic, ~/browsentic, and every npx cache directory holding a copy of the package. Sessions are revoked through the live daemon first, so a connected browser is told it is unpaired rather than left to discover it.

It names, but will not touch, the extension card at chrome://extensions, the command itself, your MCP client's entry, and any directory you moved with screenshotDir, downloadDir or skillsDir.

update now reaches past its own cache (4517fda)

npx browsentic setup puts nothing on your PATH: it runs the package out of npm's throwaway cache, and npm records the version it resolved the first time and reuses it forever without consulting the registry again. Because the extension ships inside the package, update had nothing newer to install and answered "already current" every time, and a reinstall after the documented manual uninstall landed on that same old build. It looked like the installer was broken.

setup and update now check the registry and replace the command itself before installing anything. A pinned npx browsentic@<version> is never upgraded past, a source checkout is told rather than touched, and --no-self-update opts out.

stop finds a daemon whose lockfile is gone (4517fda)

rm -rf ~/.browsentic takes the lockfile with it, and the running daemon never notices: it held its port for as long as the machine was up, invisible to everything that reads ~/.browsentic. stop now probes 8765–8767 for whatever is actually answering, then SIGTERMs and, if it must, SIGKILLs it.

update no longer promises two steps and lists one (4517fda)

--no-pair was suppressing the pairing check, not just the code, so every update told you to "Load unpacked" instead of the one thing an update needs, which is pressing ↻.

• release: the update line no longer needs an @latest to reach the newest build (2db3e42)
• Uninstalling, the npx cache and the orphaned-daemon failure are written up in maintenance, the CLI reference and troubleshooting

• files: drop files anywhere on the panel to attach them (9ca3d5e)
• panel: pick a theme for the panel, the popup and the rail (11f376d)
• voice: ask Chrome for the microphone at install time (6de4ac8)

• guardrails: judge a navigation by where it lands, not by whether it parses (2a214c9)
• panel: ask the theme whether it is dark, not a dropped class (2fad77b)

• maintenance: uninstall by install route, not by clone (d364617)

• tools: list and call the tools a site registers through WebMCP (b46af91)

• readme: refresh social card banner (65c11e0)
• readme: add npm, CI, node and license badges (46898c7)

• tools: keep an approved toolkit as a named tool for its site (9327283)

Turn the Live tool switch on, ask for something the built-in tools cannot do, and read the code the agent writes. A second after it works, the panel asks whether to keep it.

Say yes and it takes a name after the place it belongs:

youtube.com:watch:darken-page-except-video-player

From then on, type / on that site and it is there. No agent, no round trip, and no second approval, because you already read the code. That is what keeping it means.

/remove-tools lists everything you saved, with a cross beside each.

Scope is the host plus the first path segment, which is the granularity real sites are built at.

Only a zero-argument function can be kept, since / passes nothing. A toolkit whose entry point takes arguments stays a one-off, which is the honest answer for something needing input each time.

The JavaScript lives in the extension's own storage and goes nowhere else. The daemon gets a markdown note that the tool exists and what it does, never how it works, so the agent can point you at it instead of writing the same thing twice.

Nothing about a saved tool is a page action, so no MCP client can call one, with or without unattended.

• ci: release notes now come from the annotated tag rather than the commit log (d1cd070)

• guardrails: page.injectCode is now denied outright to external MCP callers, not merely gated behind a confirm (a301930)

The live tool pair is meant to be unavailable to MCP clients: there is nobody there to read the code, so nobody who can approve it. page.runCode enforced that with a hard deny, which no config can waive.

page.injectCode only used confirm. An external caller resolves a confirm through guardrails.unattended, so setting

{ "guardrails": { "unattended": "allow" } }

let an MCP client install agent-written JavaScript into the page. It also executed it: the optional call argument runs a toolkit function inside the extension without passing the guardrail a second time, so an allowed install went straight past the very rule that denies page.runCode.

The result was arbitrary JavaScript running in whatever site the tab was on, in your logged-in session, with no human ever shown the source.

Only with guardrails.unattended set to allow in ~/.browsentic/config.json. That is not the default, and it is not set unless you set it. The side panel was never affected: it shows the code behind the Review button, as it always has, and the Live tool switch still has to be on.

A new external-code-injection rule denies page.injectCode from an external caller, mirroring the external-code-execution rule beside it. A deny is not waived by unattended, so both halves of the pair are now closed by construction rather than by configuration. Four regression tests cover it, including an install carrying a piggybacked call.

• tools: live tools the user reviews before they run (fcd3869)

• panel: context-menu close and stranded-rail cleanup (2429f7b)
• panel: themed select menu for the agent model picker (bda9432)
• panel: /context shows what a conversation carries (a33c1ed)
• a-eye: picks carry a photograph of the element (8f4548d)
• agent: report token usage from the agent CLIs (cabb861)

• site-maps: keep map reviews with their conversation (e6db455)

• agent: pick each harness's model from the picker (5779cea)

• readme: route contributors through CONTRIBUTING.md first (ca4e291)
• open the door to community contributions (196cd16)
• readme: version the hero image URL past stale CDN copies (849029e)
• readme: recut the hero card in the launch voice (07a28d9)

• capture a file out of a page, not just put one into it (f741266)
• actions: read the page's console and network activity over CDP (41b19ce)

• daemon: resolve the source-checkout extension from the repo root again (95fffe4)

• cli: publish as browsentic, and install the extension with one command (e7e7fee)

• ci: keep npm pack's stdout to the tarball name (fb5821e)

• move all source under src/, split extension from daemon (3ac92be)

• cli: rewrite the install path around npx, and rename the command (51ec719)
• readme: lead with a social card that lives in this repo (17ee60c)

• timers: schedule a job the browser wakes you for (650dcaa)

• a-eye: point at an element and hand it to the agent (860474f)
• skills: attach one of the agent's own skills from a / picker (5297790)
• panel: minimize into a rail the page carries (ea8cbbc)

• internals: a flow diagram on every page, and three that animate (46564b9)

• actions: hand page text back one group at a time, resumable by cursor (c15925f)
• panel: a settings tab for the guardrails, one row per rule (c7fa72f)
• settings: describe the guardrail policy, and write one override at a time (7f7584a)
• guardrails: ask before a sealed secret is released, and refuse one in a URL (de80cd9)
• secrets: seal what the daemon and the agent write back (9186ebd)
• secrets: keep the plaintext in the extension, release it only into a page field (e6146c9)
• secrets: a deterministic sanitizer both sides of the socket can agree on (1383b0b)
• mapping: let a mapping run record where a site's search lives (bf7f4cd)
• intent: run "search this site for X" without waking the agent (acfa1de)
• actions: add page.searchSite to search a site with its own search (82613be)
• actions: add page.findSearch to report how a site can be searched (83985cf)
• actions: detect a site's search box, its toggle and its URL template (4d6f556)

• fill-input: extract typeInto so other actions can reuse the native setter (5940318)

• skills: sealed placeholders, and asking for the next group (8e7c80c)
• tools: grouped reads and the cursor page_extractText hands back (488d92b)
• guardrails: the release rules, the settings tab and the config it writes (7f44e22)
• secrets: where a credential may become plaintext, and where it may not (5379bc1)
• tools: document page_findSearch and page_searchSite (da07bc0)
• skills: teach the agent to search the site it is on, not the web (7c0801d)
• readme: illustrate the how-it-works flow, keeping the text diagram (5bbca50)
• add the security policy, disclaimer and private reporting route (d351ecc)
• readme: restructure around key capabilities, quick start and resources (1899bae)
• split the manual into a user guide, internals and a reference (46078b6)

• agent: hold the agent to short answers in a narrow side panel (0868efb)
• agent: run several tab sessions at once, one instruction per session (e9ed880)
• guardrails: let a pinned run reach the tabs it opened itself (f554cc6)
• daemon: thread runId through to the extension on every agent invoke (0517ba1)
• ui: add a collapsible sessions rail above the side panel chat (379ec10)
• sessions: give every tab its own conversation, running side by side (6c00d6c)
• bridge: add useTabSessions to observe the live session registry (28fe9ed)
• bridge: pass runId on invokes and scope conversation resets to a session (f0cdd7f)
• bridge: route agent actions to the tab their session owns (05e0d4a)
• indicator: mark a working tab on the toolbar badge and its favicon (3a70d71)
• bridge: keep a registry of tab-bound sessions in session storage (5889cd6)
• protocol: carry sessionId and runId across the socket, bump to v11 (78b6404)
• bridge: dispatch trusted drags through the Chrome debugger (d11d57e)
• page: add page.dragElement for pointer and HTML5 drag-and-drop (ec11a4d)
• cli: add browsentic-mcp restart to replace a stale daemon (e9c4fec)

• antigravity: give each run its own workspace and sweep stale ones (e35e747)
• pairing: report the daemon's close reason instead of "no daemon is running" (907a3d5)

• bridge: extract useActiveTab so callers can read the tab, not just its URL (7081d2c)
• bridge: move the run timeline reducer into its own module (d02e614)
• page: lift pointer geometry out of trusted-click into its own module (74a6a57)

• cover the renamed check scripts and the daemon restart command (ed6722a)
• describe tab-bound sessions in the architecture and feature guides (63ebd1a)
• tools: document page_dragElement and its two drag mechanisms (3acef4d)
• skills: teach the browser-control skill when and how to drag (4d9dd62)

• ui: redesign the popup and side panel (d8c7ca2)
• ui: new panel building blocks (ef516db)
• extension: agent state bridge, side panel opener and context menu (3fd8bba)
• page: register the new tools and enrich page info and screenshots (2fbecd8)
• page: read, audit and restyle page themes (9bf472f)
• page: trusted clicks through the debugger API (f971312)
• page: detect captchas and walk the agent through solving them (36c79de)
• cli: agent switching and approval management commands (25a3452)
• daemon: route every run through guardrails and the chosen agent (0611590)
• agent: split the runner into adapters for claude, codex and antigravity (69aa05e)
• mcp: remember per-site approvals granted from the panel (24203eb)
• guardrails: declarative policy, prompt fencing and spawn containment (20daaa2)
• bridge: prove both ends of the socket with a challenge-response handshake (0abf895)
• agents: add a catalog of supported agent CLIs (32db029)

• document the tools, agents and the reworked architecture (4202df9)
• publish architecture, installation and feature guides (b8fbbc0)