[github-actions]

Closes #1655. Submitted by @midego1.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1655.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Browser Prompt 0.10.3 is approved, @midego1. I pinned your requested revision and removed the intake file. Your description, overview and interface media are retained, including the clarification about model instructions; nothing is required from you.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head 5205ff14b3a49b9c60105cdaac8f04a418f65143.
• Git artifact: https://github.com/midego1/paseo-browser-prompt.git, root at requested commit 4e868613086d2b5ae389ce54211bcdb65b64f720, version 0.10.3. Compared against current main's accepted ed2c61849102ba3b475e8095f779662620321ba8. Submission identity agrees with the accepted listing and original submission.
• Independently fetched both commits without hooks or submodules, checked every archive path/type before confined extraction (111 old, 115 new). Archive SHA-256: old 2bda837c4a519f0649f82cb1b39cdf999cefcee25dd7638303b96c969cc959ed, new 1dcd19ab9c993fb0ea4c9b5227943e0ef126fbc875f3613ed2a5e39709f85fef.
• Read the full production diff, new lock/RPC modules, card integration, server registration, updater consent path and invoked update implementation, package/lock changes and displayed English overview. Revisited agent creation and update-consent UI. Unchanged launcher, report forwarding and other runtime paths retain the accepted previous review's scope; development/demo scripts are not installation or runtime inputs and were not exhaustively audited.
• Run lock: clicking Run acquires an in-memory lock keyed by source chat and block fingerprint. It is bounded to 500 entries, expires abandoned starts after three minutes, and briefly records a started agent. Failure or a five-second RPC timeout allows the start without that lock, so duplicate prevention depends on daemon responsiveness. The lock adds no network destination, filesystem access or executable text path.
• Automatic updates now reread settings and current installation after acquiring the update lock; revoked consent, unreadable state or a changed remote returns without installation. The existing subprocess receives a validated commit as a positional argument. Registry installs remain outside this self-update path. This is static verification, not an executed concurrency or updater test.
• Existing purposeful access: selected ChatGPT app/web handoff and clipboard writes; user-started agents send steps to their provider, and configured reports/questions send bounded run text to the source agent/provider. Launcher uses owned Tailscale or loopback binding. Settings and updater/run state remain local. The overview now explicitly distinguishes model instructions from tool restrictions. No new credential extraction, unrelated collector or concrete malicious behavior found in the inspected changes.
• Packaging: no manifest build command, installed runtime dependencies or installation lifecycle script. Runtime externals are host supplied. Lock changes only update root version metadata; dependency entries are unchanged. All static local imports resolve. No plugin or dependency code installed, built, imported or executed.
• Registry edits: updated artifact/repository commit and review date in plugins/midego1/browser-prompt.json, removed submissions/1655.json; preserved author description/overview and all media. The four media blobs are unchanged from the accepted artifact; their new pinned URLs return HTTP 200 and matching GIF/PNG content types.
• Trusted main registry tests: 189 passed. Committed-tree online changed-record validation: 441 well-formed records, one matching artifact. No fresh live browser/provider/UI test or exhaustive dependency audit; prompt behavior still depends on the selected model and provider.