0.4.2

Security

• The site permission check is stricter (#8,
  reported by @kurotope). Opening a tab now asks like navigating does, and both
  are judged by the site they load, not the page the agent is on. Switching to
  a tab honours a block rule and the bank rule, and asks in only-allowed-sites
  mode. Once the agent has been on a sensitive site in a chat, every later
  navigation, typing and script asks first, which makes it much harder to carry
  what it read there to another site. A blocked site is also blocked for reading. Only http(s) addresses can
  be opened. A tool you turned off in Settings can't run even if the model asks
  for it by name. Plan approval never skips the per-action prompt on a
  sensitive site. After it changes page or tab, the agent must read the new
  page before acting on it, and an action is refused if the page changed while
  you were deciding. Hovering now counts as an action.

0.4.1

Fixed

• Gemini tool calls no longer fail on the second step (#7).
  Gemini 3 models attach a thought signature to each tool call and reject the
  next request if it is missing. OpenSidekick now keeps that data and sends it
  back with the turn it came from, both on Google's OpenAI-compatible endpoint
  (extra_content) and through OpenRouter (reasoning_details). It goes only
  to the server that sent it.

v0.4.0 — Markdown in the chat

Added

• Real Markdown in the chat. Replies now render headings, tables, nested
  and ordered lists, blockquotes, task lists, strikethrough and reference
  links with markdown-it (vendored, pinned, verified against npm). Code fences
  get a language banner, a Copy button and syntax colours from Prism for 12
  common languages. Full web addresses (http or https) and email addresses
  in a reply become links; bare domains and file names such as setup.py
  do not. Links stay limited to http, https and mailto, images never load
  (one shows as an [image: alt text] marker), and raw HTML stays plain
  text, so the chat still never loads anything from the web. Single line
  breaks still break lines. Thanks @kurotope.
  (#6)

• read_page lists custom comboboxes. ARIA comboboxes (role="combobox"
  on a div or similar) now appear in the page map with their label and the
  option currently shown, so the agent can open them and pick an option, as it
  already could with <select>. A <textarea role="combobox"> keeps reporting
  what was typed into it. Thanks @reopenpilot.
  (#5)

Changed

• Contributing rules. No npm runtime dependencies still holds; a library
  may be vendored case by case when it is pinned, byte-verified against the
  official npm package, and shipped with its license. See CONTRIBUTING.md.

Fixed

• click_element fired twice. The content script dispatched a synthetic
  click and then also called el.click(), so the element's default action ran
  two times: checkboxes flipped straight back, and forms with a JavaScript
  submit handler submitted twice. Now exactly one click fires. double_click
  sends two, as a native double-click does. Thanks @reopenpilot.
  (#4)

v0.3.1 — local-model fixes

Fixed

• The Ollama preset pointed at a thinking model. Ollama's plain
  qwen3-vl:8b and qwen3-vl:30b tags are thinking builds: they spend the
  whole reply thinking, so the agent got no answer and no tool call, and the
  model test in Settings said tools didn't work. The preset now uses
  qwen3-vl:8b-instruct (about 6 GB), with qwen3-vl:30b-a3b-instruct (about
  20 GB) as the bigger pick. If you added Ollama before this release, run
  ollama pull qwen3-vl:8b-instruct, then change the model to
  qwen3-vl:8b-instruct in Settings.
  (#3)
• The model test and Fetch models now say why a local model failed. A
  reasoning model that uses the whole test on thinking gets "spent the whole
  budget thinking", with the instruct build to use instead where there is one.
  A local server that answers 403 gets the fix: set OLLAMA_ORIGINS for
  Ollama, or switch on Enable CORS in LM Studio. The message points to the
  README, with a link in the model test. Before, both cases ended in "Tools
  didn't work".

v0.3.0 — chat history

Added

• Chat history. The side panel now keeps your chats in this browser, so
  restarting Chrome or starting a new chat no longer loses the conversation. A
  History button in the top bar lists your 20 most recent chats (title, when,
  and which model answered); open one to carry on where you left off, rename
  it, or delete it, and Clear all removes every saved chat, your prompt
  history and the open chat.
  New chat now starts a fresh chat and keeps the previous one in History.
  History saves what you see in the chat — your messages and the assistant's
  replies — not screenshots, the page text the assistant read, or the steps it
  took. A very long chat keeps its most recent messages, and says so when
  older ones weren't kept. A chat in which the assistant reads, opens or
  screenshots a site on the built-in sensitive-site list (banks, payment
  processors, crypto exchanges) is never saved, and the chat says so.
  Settings → Chat history has a "Keep chat history on this device" switch,
  on by default, including for existing installs (everyone sees a one-time note
  in the chat after their first saved chat); turning it off deletes saved chats
  and your prompt history and stops saving them, so ↑ recall then only covers
  the panel you have open. Saved chats are never sent anywhere by themselves;
  continuing one sends its earlier messages to the model you are using at that
  moment. Scheduled tasks are not added to History. (#1)

Fixed

• A very long chat could fail on the next prompt after the worker restarted.
  When the chat outgrew session storage, the fallback kept the last 20 messages,
  which could begin mid-way through a tool call and make the provider reject the
  next request. The fallback now keeps the chat's text as whole turns (without
  tool steps), which providers accept.
• An approved plan no longer shows up as a message from you. Reopening a
  chat that used plan approval used to show the approval ("I approve this
  plan…") as a user bubble.

Install

• Chrome Web Store (recommended, auto-updates): https://chromewebstore.google.com/detail/idffinkmnnajgpjjonpmmaikjbpjmngk — the store copy updates once this version passes Google's review.
• Manual: download opensidekick.zip below, unzip it, open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the unzipped folder.

Upgrading

Chat history is on by default, for existing installs too. The first time a chat is saved you see a one-line note in the panel; Settings → Chat history turns it off (which also deletes any saved chats and your ↑ prompt history). Saved chats are never sent anywhere by themselves; continuing one sends its earlier messages to the model you are using now. See PRIVACY.md.

Verification

• npm test: 496 unit checks pass.
• npm run test:e2e: 247 real-browser checks pass across two suites (182 + 65).
• npm run test:rec: 5 checks pass in the recording suite.

See this week's recommended models per provider: https://opensidekick.app/models/
Full history: https://github.com/esterhuizen/opensidekick/blob/main/CHANGELOG.md

v0.2.0 — new look, auto-tested models, suggestions, model chip

Added

• Suggested models per provider. Each preset in Settings → Providers shows
  up to two suggested models as chips under the Model field (dated
  2026-10-10, tagged closed / open / budget / light). A click fills the field,
  saves it, and runs the model test once. A chip is muted when the provider's
  fetched model list doesn't include it. A "This week's picks ↗" link points to
  the live list at https://opensidekick.app/models/ (only linked, never
  fetched). Providers added from a preset now record its presetId; older ones
  are matched to their preset by the exact host of their base URL.
• Model chip and switch notice in the side panel. A chip under the top bar
  shows the active model and provider and opens Settings when clicked.
  Switching the model in the middle of a chat adds a one-time note ("Now using
  … via …. Replies continue in this chat.") with a New chat button. A
  reopened panel shows the same note if the model changed while it was closed.
• The agent knows which model it is. The system prompt now names the
  configured model id and provider (never the key or base URL), so "which
  model are you?" gets the right answer.

Changed

• Preset defaults refreshed. Each provider preset now pre-fills its current
  balanced pick (as of October 2026), e.g. Claude Sonnet 5.5, GPT-5.6 Terra,
  Gemini 3.8 Flash, Qwen 3.8 27B on Groq, Qwen3-VL 8B for Ollama. LM Studio keeps an empty
  default because its model ids depend on what you have downloaded.
• Visual polish, second pass. The side panel opens on one quiet question
  ("What should I do on this page?") just above the composer instead of a
  landing-page hero, and Send is now an icon button inside the input with the
  Plan / Ask / Auto control directly under it. Indigo is kept for Send and the
  active state; elsewhere the panel, Settings and the on-page pill use warm
  off-white paper (near-black in dark mode), a 12/13/14/16/20 px type scale and
  4/8/12 px radii. Settings marks the active provider with an "Active" tag and
  folds long hints under "Learn more". Focus rings are visible, panel targets
  are at least 32 px, and nothing works differently.
• Models are tested the moment you pick them. Choosing or typing a model id
  in Settings → Providers (or pasting the key for a provider whose model is
  already filled in) now runs the three-probe suitability test automatically,
  with a live "Testing…" progress line that fills in ✓/⚠/✗ for text, tool
  calling and vision as each probe finishes. Picking another model mid-test
  cancels the first. The Test button is still there for re-runs.
• Visual refresh, first pass. One shared token sheet (src/common/ui.css,
  lifted from opensidekick.app) now drives the side panel, the settings page
  and the on-page activity pill; header buttons use inline SVG icons instead of
  Unicode glyphs; the settings page gains a section sidebar with status tags;
  the activity ring is thinner and Stop is a ghost button so a normal run no
  longer reads as an error. No behaviour changes; every test selector kept.

Install

• Chrome Web Store (recommended, auto-updates): https://chromewebstore.google.com/detail/idffinkmnnajgpjjonpmmaikjbpjmngk — the store copy updates once this version passes Google's review.
• Manual: download opensidekick.zip below, unzip it, open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the unzipped folder.

Verification

• npm test: 417 unit checks pass.
• npm run test:e2e: 214 real-browser checks pass across two suites, plus the recording suite.
• Every text colour pair in the new token sheet passes WCAG AA in light and dark; control borders meet the 3:1 non-text line.

See this week's recommended models per provider: https://opensidekick.app/models/
Full history: https://github.com/esterhuizen/opensidekick/blob/main/CHANGELOG.md

v0.1.9 — Smart checks (Jev), loop detector, MCP permission gate

Added

• Smart checks (beta, optional) — Settings → Smart checks. Fast yes/no
  safety verdicts from TypeSafe's Jev decision model, used to catch what the
  built-in pattern matching misses. The key source is yours to pick: one of your
  existing OpenRouter provider keys (requests go to
  https://openrouter.ai/api/alpha/decisions) or a TypeSafe key
  (https://api.typesafe.ai/v1/systemone). Three checks, each switched on
  separately:

  • Check risky actions before acting — asks you first when a click, type or
    navigate looks like a purchase, payment, deletion or send, even in Auto.
    It can only ever add a confirmation the built-in rules would have let
    through; it can't relax one, unblock a site, or override a site rule.
    Unattended scheduled runs have nobody to ask, so a confirmation there stops
    the task instead.
  • Classify page text for hidden instructions — a prompt-injection
    classifier layered on top of the built-in heuristic, which stays as an
    unconditional floor. It never runs on a site matched by the built-in sensitive-site list (banks, payment
    processors, crypto exchanges); there, only the built-in check applies.
  • Scheduled tasks: only notify when the result changed — compares a run's
    result with the previous one and stays quiet when nothing material changed.
    Beta: it compares the model's own wording, so a reworded but unchanged
    answer can still count as a change. A task's first run, a failed run, and
    every sixth quiet run always notify.

  A Sensitivity setting (Cautious / Balanced / Permissive) sets how much
  certainty it takes to escalate, and a Test button runs one live request
  with two known answers and reports the measured latency. All of it is off
  until you supply a key and switch a check on, and on any failure — no key, an
  error, a timeout, or three failures in a row — the agent behaves exactly as it
  does with smart checks disabled.

  Privacy: short extracts go to the one endpoint you picked — the page text just
  read for the injection check; the tool name, page URL and title, the target
  element's label (or destination URL) and up to 500 characters of your own
  instruction for the action check; the task name, prompt and last two run
  summaries for change-only notifications. Text the agent types into a page is
  never sent, an instruction that looks like it carries a credential is withheld
  entirely, and no identifiers (user, session_id, trace) are ever sent —
  there is still no account and no telemetry. PRIVACY.md lists
  exactly what each check sends.

• Loop detector. The agent is now stopped from running the exact same action
  (same tool, same arguments) three times in a row: the fourth attempt is
  refused and the model is nudged to try a different element or a different
  approach, with one warning in the chat. Reads, scrolls, waits and screenshots
  are exempt — repeating those is normal. Pure JavaScript; no key or smart check
  needed.

Fixed

• MCP tool calls now respect your autonomy mode. Tools from your MCP servers
  were dispatched before the permission gate, so ask and plan modes
  never confirmed them — even though an MCP tool can send mail, move files, or
  change a repository. Ask/plan now confirm the first call per server per task
  ("Allow for this session"), and a decline sticks for the rest of the run
  instead of re-prompting on every step. Auto is unchanged, and scheduled
  runs — which already run as auto — are unchanged.
• Saving settings no longer pushes every scheduled task's next run back.
  Scheduled alarms were cleared and re-created on every config change, so each
  edit reset every task's countdown to a full interval. Alarms whose schedule
  hasn't changed are now left alone, including their next fire time.
• An unattended scheduled run that needed a confirmation is no longer reported
  as "Done." Unattended runs decline prompts (nobody is watching to approve),
  which cuts the run short; the notification now says which tool needed
  confirmation, and such a run is never silenced by change-only notifications.

Install

• Chrome Web Store (recommended, auto-updates): https://chromewebstore.google.com/detail/idffinkmnnajgpjjonpmmaikjbpjmngk — the store copy updates once this version passes Google's review.
• Manual: download opensidekick.zip below, unzip it, open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the unzipped folder.

Verification

• npm test: 329 unit checks pass (174 new: the decision client, parsers, fallback and circuit-breaker paths, secret filtering, source resolution).
• npm run test:e2e: 161 real-browser checks pass across two suites, including the Smart checks flows against a mock decision server, the MCP permission gate in ask/auto modes, the loop detector, and change-only notifications.
• Independent security audit of the diff (max effort) before release; its findings were fixed and re-audited.

Full history: https://github.com/esterhuizen/opensidekick/blob/main/CHANGELOG.md

v0.1.8 — Venice AI provider

Added

• Venice AI provider preset (Settings → Providers → Add a provider).
  Privacy-focused inference with open-weight and frontier models over Venice's
  OpenAI-compatible API. OpenSidekick turns off Venice's injected default system
  prompt (include_venice_system_prompt: false) so the agent's own instructions
  aren't diluted, strips <think> blocks from reasoning models' replies, and
  pins the catalog query to text models so Venice's image/TTS/embedding models
  can never appear in Fetch models, even if Venice changes that default.
  The preset pre-fills qwen-3-8-27b — Venice's default vision model, which
  supports tool calling and vision per Venice's model catalog. Get a key at
  venice.ai/settings/api.

Install

• Chrome Web Store (recommended, auto-updates): https://chromewebstore.google.com/detail/idffinkmnnajgpjjonpmmaikjbpjmngk — the store copy updates once this version has been uploaded and passes Google's review.
• Manual: download opensidekick.zip below, unzip it, open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the unzipped folder.

Verification

• npm test: 155 unit checks pass (44 new for Venice: preset shape, host matching, request body, model-list query).
• npm run test:e2e: real-browser suite passes (89 checks), including a new options-page flow that adds and removes the Venice preset.

Full history: https://github.com/esterhuizen/opensidekick/blob/main/CHANGELOG.md