Garry TanandClaude Fable 5 2dfd6edeee fix(browse): 403 hint stops recommending --admin; invariant names both scope defaults ...

The scope-denied hint told restricted agents to "re-pair with --admin for
eval/cookies/storage" — but --admin is a legacy alias for --control, so
following it over-granted browser-wide destructive commands on top of the
admin scope the default already carries. The hint now matches the CLI's
sibling wording: re-pair without --restrict for page access, --control for
browser control.

Registry invariant #2 claimed "admin scope denied by default" three releases
after b73f3644 deliberately made /pair grant admin. It now names BOTH
defaults precisely (registry API functions default read+write; the /pair
ceremony grants DEFAULT_PAIR_SCOPES) so the header cannot lie one layer down.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-20 04:00:42 +00:00

..

activity.ts

feat: content security — 4-layer prompt injection defense for pair-agent (#815)

2026-04-06 14:41:06 -07:00

audit.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

browse-client.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

browser-manager.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

browser-skill-commands.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

browser-skill-write.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

browser-skills.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

buffers.ts

feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29)

2026-03-13 00:31:41 -07:00

bun-polyfill.cjs

v1.67.1.0 fix: external-contributor security sweep — 6 findings hardened, regression-pinned (#2605)

2026-08-17 07:50:37 -07:00

cdp-allowlist.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

cdp-bridge.ts

v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751)

2026-05-27 16:09:38 -07:00

cdp-commands.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

cdp-inspector.ts

v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751)

2026-05-27 16:09:38 -07:00

claude-bin.ts

v1.24.0.0 feat: cross-platform hardening — curated Windows lane + Bun.which resolver + path-portability helper (#1252)

2026-05-01 07:21:28 -07:00

cli.ts

fix(browse): CLI always sends explicit pair scopes via shared DEFAULT_PAIR_SCOPES

2026-08-20 04:00:04 +00:00

commands.ts

v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) (#1929)

2026-06-09 21:02:30 -07:00

config.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

content-security.ts

fix(browse): case-insensitive exfiltration-domain blocklist matching

2026-07-10 14:39:32 -07:00

cookie-import-browser.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

cookie-picker-routes.ts

community wave: 6 PRs + hardening (v0.18.1.0) (#1028)

2026-04-17 00:45:13 -07:00

cookie-picker-ui.ts

fix: cookie picker auth token leak (v0.15.17.0) (#904)

2026-04-08 10:10:13 -07:00

domain-skill-commands.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

domain-skills.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

error-handling.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

file-permissions.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

find-browse.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

find-security-sidecar.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

media-extract.ts

feat: browser data platform for AI agents (v0.16.0.0) (#907)

2026-04-08 00:41:55 -07:00

memory-command.ts

v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751)

2026-05-27 16:09:38 -07:00

memory-snapshot.ts

v1.51.0.0 feat: $B memory diagnostic + 4 CDP-resource leak fixes (#1751)

2026-05-27 16:09:38 -07:00

meta-commands.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

network-capture.ts

feat: browser data platform for AI agents (v0.16.0.0) (#907)

2026-04-08 00:41:55 -07:00

path-security.ts

fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0) (#988)

2026-04-13 07:49:37 -10:00

platform.ts

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

port-allocator.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

project-slug.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

proxy-config.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

proxy-redact.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

pty-session-cookie.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

pty-session-lease.ts

v1.44.0.0 feat: long-lived sidebar — keepalive, restart, re-attach, scrollback replay (#1678)

2026-05-24 01:43:51 -07:00

read-commands.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

sanitize.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

screenshot-size-guard.ts

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00

security-classifier.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

security-sidecar-client.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

security-sidecar-entry.ts

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00

security.ts

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

server.ts

fix(browse): 403 hint stops recommending --admin; invariant names both scope defaults

2026-08-20 04:00:42 +00:00

session-cookie-store.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

session-persist.ts

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

skill-token.ts

fix(browse): revokeToken deletes ALL tokens for a clientId, not the first Map hit

2026-08-20 03:48:23 +00:00

snapshot.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

socks-bridge.ts

v1.28.0.0 feat: browse --headed/--proxy/--navigate + gstack/llms.txt + webdriver-only stealth (#1363)

2026-05-07 20:14:59 -07:00

sse-helpers.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

sse-session-cookie.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

stealth.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

tab-session.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

telemetry.ts

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

terminal-agent-control.ts

v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)

2026-08-15 09:37:04 -07:00

terminal-agent.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

token-registry.ts

fix(browse): 403 hint stops recommending --admin; invariant names both scope defaults

2026-08-20 04:00:42 +00:00

tunnel-denial-log.ts

v1.30.0.0 fix wave: 21 community PRs + Windows CI extension + codex flag-semantics smoke (#1391)

2026-05-09 08:06:47 -07:00

url-validation.ts

v1.64.0.0 fix wave: full tracker audit — 90 fixes, 52 issues closed, ~50 community PRs absorbed (#2571)

2026-08-14 22:02:07 -07:00

welcome.html

feat: GStack Browser — double-click AI browser with anti-bot stealth (#695)

2026-04-04 10:17:05 -07:00

write-commands.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

xprotect-heal.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00

xvfb.ts

v1.68.0.0 fix: next tracker wave — 16 verified fixes in, 90 stale PRs and 21 issues closed with receipts (#2632)

2026-08-19 11:42:55 -07:00