jakevin
654019eeba
* fix(plugin): pass --ignore-scripts to plugin npm install (#1753) Plugin repos are cloned from untrusted third-party Git URLs. Without --ignore-scripts, `npm install` runs preinstall/install/postinstall lifecycle scripts (of the plugin and every transitive dep) at install time with the user's privileges. Adapter plugins don't need lifecycle scripts — adapter code is loaded later by the discovery path — so deny that execution vector unconditionally. Adds a test asserting the flag. * fix(chatgpt): verify whoami via /api/auth/session, not legacy cookie (#2087) verifyChatgptIdentity hard-gated on the legacy `__Secure-next-auth.session-token` cookie before probing /api/auth/session, so logged-in users on cookie-less sessions got a false AUTH_REQUIRED. The session endpoint (200 + user.id) is authoritative; drop the cookie precondition from verify. The login `poll` keeps its cheap non-navigating cookie gate so verify (which navigates) doesn't run every ~2s and yank the user off the OAuth form. Also prefix-match the session cookie so the quickCheck/status/refresh fast paths stop false-negativing on NextAuth chunked (.0/.1) cookies. * fix(instagram): collect explore_grid media across nested layouts (#2091) Instagram stopped populating the flat layout_content.medias[] path; media now nest across mixed layout shapes (one_by_two_item.clips.items[] .media, fill_items[].media, ...), so explore returned []. Recursively walk each sectional item collecting every distinct node.media, dedupe by pk/id/code (skipping descent into a collected media so carousel children aren't counted as separate posts), and fall back to play_count for clips/reels engagement. * fix(extension): upload files via file-chooser interception (#2108) DOM.setFileInputFiles with a nodeId/backendNodeId is rejected "-32000 Not allowed" when the debugger is attached via chrome.debugger (crbug 928255), breaking file upload on every site. Switch setFileInputFiles to the file-chooser interception flow: enable Page.setInterceptFileChooser- Dialog, programmatically open the chooser, and use the backendNodeId from the intercepted Page.fileChooserOpened event (which Chrome accepts). The event listener is registered before the click and settles on any matching event so a malformed one rejects fast. Includes the rebuilt bundle. * fix(chatgpt): use page.sleep in the poll loops #2099 missed (#2095) #2099 converted the main streaming loops to page.sleep but did not touch image.js, deep-research-result.js, or the image-poll re-navigation waits in utils.js. Those still called page.wait(n>=1), which injects a whole- subtree+attributes MutationObserver DOM-stability wait rather than a sleep — during ChatGPT streaming the observer never goes quiet and pegs the renderer. Convert the remaining poll-loop sleeps to page.sleep; one-shot post-navigation settles are left as-is.
OpenCLI Browser Bridge Extension
The extension connects Chrome tabs to the local OpenCLI daemon. It uses Chrome extension APIs only as a transport and browser-control layer for explicit CLI commands.
Permission Notes
debugger: sends CDP commands to OpenCLI-controlled or bound tabs.tabs/tabGroups: manages the dedicated OpenCLI automation container and reports selected tab metadata back to the CLI.cookies: reads cookies for browser-backed adapters that need authenticated fetches.downloads: surfaces download lifecycle toopencli browser wait download. The extension observes started / in-progress / completed / failed downloads so the CLI can wait for a file triggered by an automation command. OpenCLI filters by the command's filename/URL pattern and timeout, and does not modify, redirect, or persist browser download history.
Suggested Chrome Web Store justification for downloads:
This extension uses
chrome.downloadsto surface download lifecycle (started / in-progress / completed / failed) to the OpenCLI command-line tool, so agents can wait for downloads triggered during an automation workflow. The command filters by a user-provided filename or URL pattern and timeout. We do not modify, redirect, or persist user download history.