AgentBoard v0.10.0

Agents can now read what you are actually looking at: article text, PDFs, and page images, from the exact document in the exact tab. Page reading moved out of page-owned registration and into an extension-owned system tool, so a page cannot impersonate, replace, or observe the reader.

• Reads are bound to one exact document. If the tab navigates mid-read, the call fails instead of returning another page's content.
• Article extraction runs in a private isolated host that page scripts cannot see or monkey-patch.
• PDFs are parsed by a local worker, including PDFs behind a login and PDFs you opened from your own disk (file://).
• PDF reads return bounded full-page images by default, up to 25 pages, so figures, charts, and layout survive.
• HTML reads attach one bounded screenshot of the visible viewport, plus scroll context locating that viewport inside the extracted Markdown.
• Local file paths stay out of tool results shared with the model.

WebMCP conformance

The polyfill is now tested against upstream Web Platform Tests using wptrunner from a pinned sparse checkout, running the exact built polyfill in an isolated Chrome profile — no forked copies of the WPTs, no private reporter.

• Registration and execution failures now match Chromium: invalid schemas reject through the returned promise, and malformed inputs, missing tools, and callback failures map to consistent errors.
• Stop now reaches running tools. Each invocation gets its own cancellation signal, and tools receive lifecycle events so they can cooperate rather than being abandoned.
• window.ModelContext is exposed, so interface detection and instanceof work instead of only functional calls.
• Tool calls are bound to the route that issued them. Side-effecting calls are delivered exactly once and cannot be replayed into a different document after navigation.
• YouTube transcript work now cancels on abort instead of running on after Stop.

Reliability

• Browsing with the sidebar closed no longer reconnects to every configured MCP server on each page load. The service worker wakes on any navigation in any tab, and a stale token turned that into an unbounded 401 loop paced by ordinary browsing.
• The Options page no longer eagerly parses ~1.4 MB of service-worker runtime it never used.
• Reloading or updating the extension no longer leaves red console errors on the extensions page. The relay already shut down correctly; it just complained on the way out.

Agent behavior

• When a tool fails, you and the model see why. Failures used to render as Tool execution failed with no output, so the model could not tell a stale extension from a network error from a bad argument, and it retried blindly.
• Tool results now travel with the conversation. Continuations previously reached the model with the assistant's prose but no record that any tool had run, which produced confident summaries of work the model could no longer see.
• MCP servers judge their own schemas. A server that reworded a description or grew an enum default no longer has every call refused locally before it is sent.
• Memory is written before the reply, not promised after it, and curation is gated on whether a fact is durable and clearly useful later.

Full changelog: v0.9.0...v0.10.0