v0.3.0 — Pin the extension's origin (TOFU)

The HTTP bridge's Origin allowlist previously matched by scheme only (chrome-extension://… / moz-extension://…), which any installed extension satisfies equally — not just BraveMCP's own. A malicious or compromised neighbor extension could talk to /api/capture, /api/note, /api/stage-groups, etc. exactly as freely as the real extension. This is the same "unauthenticated internal channel trusts any sender" gap disclosed in Claude for Chrome's extension-messaging vulnerability (2026-07), applied to a directly comparable architecture.

Security

• Extension-origin pinning (trust-on-first-use): pins the specific extension origin seen on first contact (storage/trusted-origin.json, git-ignored) and rejects every other extension-shaped origin afterward — zero configuration required. See the Security section in the README for the re-pinning steps if you ever move the repo to a new path.

Testing

• 7 new tests covering the pinning decision logic and persistence; 35 tests passing (was 28). Verified end-to-end against a live server with curl: first extension origin is trusted and pinned, survives a server restart, and a second/different extension origin gets 403 even though it passes the scheme check.

Full changelog: CHANGELOG.md

v0.2.0

First tagged release since 0.1.0. Bundles months of accumulated work
plus a security fix found while auditing the project.

Security

• HTTP bridge CORS lockdown: the Express bridge on localhost:3747
  previously accepted requests from any origin, meaning any website open
  in the browser could POST to /api/capture, /api/note,
  /api/stage-groups, etc. and write attacker-controlled content into
  the local memory database or stage arbitrary tab groups. Replaced with
  an explicit Origin allowlist restricted to the extension's own origin.

Added

• Tab grouping: get_all_open_tabs and apply_tab_grouping tools,
  backed by a critic engine that rejects domain-name or catch-all group
  names before they reach the browser.
• Automated test suite (Node's built-in test runner), ESLint + typecheck
  in CI, and a live /api/status health check.

Changed

• Genuine extractive AI-fallback summaries when no LLM is configured.
• README rewrite: fixed a placeholder clone URL, corrected the MCP tool
  count (13 -> 16, two tab-grouping tools were undocumented), added a
  Security section.

Fixed

• MCP stdio corruption from dotenv's stdout output.
• Dual-process state handling and tool-error reporting.

Full history: see CHANGELOG.md.