0.2.0

The bridge and the extension change together in this release. Update both.

Upgrade

• The default bridge port moved from 9223 to 19223. An extension loaded from 0.1.x still dials 9223, so with the 0.2.0 bridge its badge stays off until you update it. npx can keep running a cached copy; npx -y opencode-chrome@0.2.0 gets this one.
• If you load the extension from a clone, git pull and press reload on it in chrome://extensions. If you use the zip attached to this release, remove the old extension, "Load unpacked" the new extension/ folder and paste the token again in its options page.
• Need another port? Set OPENCODE_CHROME_PORT for the bridge and the same number in the extension's options page (bc5272e).
• The extension now needs Chrome 116 or later and asks for the downloads permission, which wait_download uses.
• Node 20 or newer is now the floor (Node 18 is EOL).

More than one terminal

• A second MCP client no longer dies with EADDRINUSE. With the default of one session, it attaches to the bridge that already holds the port as a peer: token required, no Origin, and it can never replace the extension's connection (128ce53).
• You choose how many sessions run at once, from 1 to 10, under Sesiones in the extension options. Above one, each new terminal takes the next port and only sees the tabs attached to that port. The cap lives in ~/.config/opencode-chrome/config.json, and only the extension can change it (5908075).
• OPENCODE_CHROME_SESSION names a terminal. The name only shows when more than one session is connected.
• An extra session reconnects when its port drops (d104d4f).
• Above one session, wait_download fails with downloads_not_isolated, because chrome.downloads does not say which tab a file came from. With one session it still returns the latest download (e024561).

Human oversight

• Sensitive fields are redacted in snapshots: password inputs, autocomplete="cc-*", and inputs labeled CVV, CVC, CSC, SSN, social security, security code, card verification or tax ID. Any action on one of those refs stops with human_takeover_required. You fill the field yourself, then tell the agent to continue (b8ccf4d).
• press_key refuses to type text into a focused sensitive field (92d5b5b).
• SSO redirects: per-origin exceptions live in ~/.config/opencode-chrome/policy.json, on the bridge side only, where a page cannot reach them. A cross-origin navigation keeps the tab attached only when the new origin is in that list (845b3fd, f6a3f47).
• Out-of-process iframes are reachable only when the frame's origin passes the same policy (f8e3713).
• Site recipes: declarative per-origin adapters in ~/.config/opencode-chrome/adapters/, run with run_recipe. There is no free-form eval tool, and init_script can only come from an adapter (ffcf632, 27dfa6e).

Known gaps: a card-number field without autocomplete="cc-*" and without one of those labels is not detected, and screenshot does not redact what the page shows.

New tools (11 to 35)

• Forms: fill, select, upload, form_schema, apply_mapping, list_profile_keys.
• Input: press_key, hover, drag, scroll.
• Reading: find, read_text, list_frames, list_storage_keys, list_console_messages.
• Network and downloads: list_network (with HAR export), get_network_body, wait_download.
• Dialogs: list_dialogs, handle_dialog.
• Page: emulate, resize_page.
• Recipes: list_recipes, run_recipe.

Snapshots, actions and errors

• Cheaper snapshots with selector, interactive_only, max_chars and in_viewport_only.
• Refs carry a fingerprint with a match_level (exact, reidentified or stable), and screenshot can annotate refs with set-of-marks badges.
• Clicks, hover and drag are trusted CDP input events.
• Mutating actions can return a fresh snapshot (include_snapshot), and large payloads can go to a file (output_path).
• Every tool failure carries a stable error_code and a remedy next to the message (9c7591d).

Fixes

• Steadier reconnects and bridge shutdown (97c6b35). The worker wakes on install and on browser startup (6428045).
• reload respects ignore_cache instead of always bypassing the cache (e283fb9).

v0.1.2

What's Changed

• Hardening de review: token WS, alarms, fingerprints de refs by @G10hdz in #1
• Nuevo logo: iconos de extension y masters en assets/ by @G10hdz in #2
• docs: mejora README, agrega AGENTS.md y CONTRIBUTING.md by @G10hdz in #3
• feat: baja fricción de pareo del token (v0.1.1) by @G10hdz in #4
• docs: README con gancho, diagrama arriba y sesion de ejemplo by @G10hdz in #6
• docs: improve README onboarding by @G10hdz in #7
• docs: define browser product spec by @G10hdz in #8
• docs: define browser architecture by @G10hdz in #9
• feat: require explicit attached tabs by @G10hdz in #10

Full Changelog: https://github.com/G10hdz/Opencode-chrome/commits/v0.1.2