[github-actions]

Closes #1624. Submitted by @midego1.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1624.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Browser Prompt needs explicit consent before self-updating, @midego1. I completed and pushed the pinned registry record, kept your description, overview and interface GIF, and removed the intake file.

On a Git installation, merely displaying a card can download and install newer plugin code because auto-update defaults to on. Please remove this automatic installation path, or make it off until the user explicitly opts in after being told which repository supplies the updates and that new code will be installed. Declining must leave it uninstalled, including on the first card render and with unreadable settings. Update the overview to match, push the revision, and reply here with its branch or commit; I’ll update the pin. Runtime installation and consent guidance.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head: fd8bc5fc2f1f6e32df39ddb5ac8ac3e23782b745.
• Artifact: https://github.com/midego1/paseo-browser-prompt.git, root at a3aed64648f9a3bb89075d968797256f2086eb54, version 0.7.0. Resolved main because the submission supplied no reference. Submission author and repository owner agree. Fetched without hooks/submodules; all 86 archive paths/types checked before confined extraction. Archive SHA-256: f416855dfbec7eaba85ca497e02c254d8623fc940cf5dea6880d820136d958d0.
• Inspected client/server registration, card actions, launcher and HTML handoff, agent configuration/prompt and mode guard, report/question forwarding and persistence, screenshot/step tracking, updater, settings, manifest/package/lock metadata and displayed overview. Static local imports resolve. Demo/development tooling is outside the installation and runtime entry paths and was not audited exhaustively. No plugin or dependency code was installed, built, imported or run.
• Installation: no manifest build command or runtime npm dependencies. External runtime libraries are supplied by Paseo. The development lock has 317 dependency entries with npm registry sources/integrity; its fsevents install hook is development-only.
• Blocking path: shared/updater.ts sets DEFAULT_UPDATE_STATE.autoUpdate to true. client/card.tsx:114 calls onFirstRender; client/update.ts calls update.check when the default-enabled settings load. For an HTTPS Git installation with a newer fast-forward branch commit, the updater reaches spawnUpdate without asking the user. server/updater.ts:150 invokes paseo plugin update browser-prompt --ref <commit> --yes through a detached shell with positional arguments. Registry/npm identities are skipped by parseInstallInfo; the defect described here concerns the Git-install branch. HTTPS and ancestry checks constrain origin/history but do not supply consent. No malicious intent is alleged.
• Purposeful access: launcher invokes tailscale ip -4 and binds only an owned Tailscale IPv4 or explicit loopback. Prompt handoff uses a random one-use id with ten-minute expiry and escaped HTML/CSP. ChatGPT actions write the clipboard and open the configured app or ChatGPT URL; short prompts without recognized token patterns can be included in that URL. Pattern detection does not cover every secret.
• Browser runs are user-started, use the connected host's agent/provider and workspace, and send task steps to that provider. The browser-only and dangerous-action rules are prompt instructions, not a tool sandbox; runtime behavior depends on provider/model enforcement. Actual mode checks stop recorded runs in refused modes. Reports/questions read recorded run timelines and send escaped, image-stripped text to the source agent; questions can reach any source mode, while automatic full reports require a known ask-first mode. The overview discloses provider transmission and controls. No separate telemetry collector or unrelated credential-file read was found in inspected runtime paths.
• Filesystem writes are plugin settings and its state directory (run ids, updater history/state/lock/log). Updater shell arguments are positional, revisions are checked, and no daemon restart is requested.
• Listing: created plugins/midego1/browser-prompt.json, preserved categories/submitter and original submission time, removed submissions/1624.json. Author overview and description retained, no redundant registry copies. Viewed the shipped GIF; its pinned public URL returns HTTP 200 with image/gif.
• Trusted registry tests: 189 passed. Changed-record online validation: 437 well-formed records, this record matches its pinned artifact. Structural checks do not satisfy the separate runtime-consent requirement. Static inspection only; no live plugin/provider/browser or updater execution. No approval or merge; listing remains unpublished.

[midego1]

Thanks for the review. Auto-update is now off by default and requires explicit, informed consent naming the exact remote (Settings → Updates). Declining, or unreadable settings, installs nothing, including on first card render. The check is enforced daemon-side, consent is tied to the install remote, pre-0.10.0 settings are reset to off, and the manual "Update now" installs only the shown commit on click. [OVERVIEW.md](OVERVIEW.md) is updated to match.

Please pin branch main, commit ed2c61849102ba3b475e8095f779662620321ba8 (v0.10.2).

[paseo-bot]

Browser Prompt 0.10.2 is approved, @midego1. Your update-consent change resolves the publication blocker. I pinned the revision you requested and retained your description, overview and updated interface media; nothing is required from you.

For a later release, clarify in the overview that the browser-only and secret-handling rules are model instructions, so readers understand that their enforcement depends on the selected provider and model. Overview guidance.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head a053b8781888af33341186e0d81650238e68470d. Read the full PR/issue discussion, including the author's exact revision request.
• Git artifact: https://github.com/midego1/paseo-browser-prompt.git, root at requested commit ed2c61849102ba3b475e8095f779662620321ba8, version 0.10.2. Independently fetched old a3aed64648f9a3bb89075d968797256f2086eb54 and new trees without hooks/submodules; checked every archive path/type before confined extraction (86 old, 111 new). SHA-256: old f416855dfbec7eaba85ca497e02c254d8623fc940cf5dea6880d820136d958d0; new 2bda837c4a519f0649f82cb1b39cdf999cefcee25dd7638303b96c969cc959ed.
• Compared all 60 changed files, read changed production paths for updater/settings, repeated blocks and shared runs, card permission responses, timeline indexing, step status and screenshot presentation. Revisited current entry registration, browser-agent creation, mode guard, launcher and handoff. Unchanged report/question forwarding and persistence retain the prior review's evidence; demonstration/development tooling and dependency internals are not an exhaustive fresh audit. Required entries and static local imports resolve.
• Consent trace: shared/updater.ts:151 defaults autoUpdate to false. The version-2 settings migration at lines 416-426 resets older consent. client/update.ts skips checks while settings are unavailable or consent absent. server/updater.ts:197-207 treats unreadable settings as off; shared/updater.ts:255-257 returns before install discovery/network, and lines 291-300 reject another remote's consent before ls-remote. Settings show the exact remote and disclose automatic code installation before Enable auto-update. Check now is a user action; without consent it only checks history and records availability. Update now supplies the shown remote/revision; the daemon rejects a changed remote or newest revision and requires a fast-forward before its detached positional-argument paseo plugin update ... --ref <commit> --yes. No automatic path bypassing the reviewed consent checks was found. These are static conclusions, not an executed updater test.
• New owner permission controls read the run snapshot, verify source/card labels and send responses only on clicks. Allow requires another confirmation click, and requests with incomplete displayed tool input offer Deny/Open run instead. Repeated-card indexing reads up to 25 pages of 200 entries from that chat, fingerprints blocks locally and shares done/run state within the same source agent; no new external destination or executable model-output path in these additions.
• Purposeful access retained: clipboard writes and chosen ChatGPT app/web handoff; short prompts without recognized secret patterns can be included in the ChatGPT URL. Pattern detection is not comprehensive. A one-use random launcher id expires after ten minutes; its listener binds only an owned Tailscale IPv4 or explicit loopback. User-started browser runs send steps and screenshots to the chosen agent provider. Reports/questions can send escaped bounded run text to the source agent/provider according to settings. Browser-only and secret-handling instructions are prompts, not a tool sandbox; actual behavior depends on provider/model enforcement. Mode checks inspect recorded runs, but failure to obtain an actual mode is reported as unverified rather than stopping a run.
• Filesystem state remains settings, recorded report ids and updater state/history/log/lock under the plugin's state directory. Intentional subprocesses are fixed-argument Tailscale/Git/Paseo commands and the quoted positional update wrapper. No unrelated credential-file extraction, collector, or confirmed malicious behavior found in inspected paths.
• Packaging: no manifest build, runtime npm dependencies or dependency installation. The unchanged development lock contains 317 npm registry resolutions with integrity; fsevents' lifecycle is development-only. No plugin/dependency code installed, built, imported or run.
• Registry edit: refreshed artifact/repository pin and review/publication dates in plugins/midego1/browser-prompt.json. Author description/English overview/media retained; no redundant registry fallback. Viewed all three new listing PNGs and the GIF's initial frame; all four pinned URLs return HTTP 200 with matching image types. Animation was not inspected frame by frame.
• Trusted main validator scripts are unchanged. Committed-tree online changed-record validation passed: 437 well-formed records, one matching artifact. The same trusted registry suite passed all 189 tests during this execution. Static inspection only; no live browser/provider/UI or update execution, and no guarantee that prompt instructions constrain arbitrary provider behavior.