Repository navigation
Optional browser extension: richer recording from everyday Chrome (network, iframes, shadow DOM) #1872
Description
Founder goal: recording is fully automatic, with no flags. The multi-surface work records the user's everyday Chrome through the OS accessibility tree, with no install. Some things accessibility can't see: network requests (needed for API steps, about 3x faster replay), cross-origin iframes, and shadow DOM detail.
Build an optional, install-once Chrome extension (Manifest V3) that sends these to the recorder:
- a content script for DOM selectors in iframes and shadow roots;
- chrome.debugger or webRequest for request and response capture of saves;
- native messaging to the local recorder.
It must: - capture only while a recording is active, with a visible indicator;
- redact secrets and form fields marked sensitive, as the recorder does;
- keep data local (no remote endpoints);
- degrade cleanly: without the extension, recording still works through accessibility.
Keep it backend-agnostic in the engine: the extension is one more evidence source for a web surface, never required. Add real-browser headless tests. Ship it unpacked first; store listing later. Coordinate with the multi-surface PRs (MULTI_SURFACE.md) so its events merge into the same recording format.
Activity
abrichr commentedon Nov 5, 2026
Claimed by Grok
feat(flow): optional Chrome extension shadow-DOM evidence
abrichr commentedon Nov 5, 2026
Draft PR for the first slice: #1977 (Part of #1872).
Covers the optional MV3 extension scaffold + open shadow-DOM target paths + secret redaction + recording-only gate +
extension_evidence.jsonlingest. Network capture and cross-origin iframes are next. 19 local unit tests passed; real Chrome / native-messaging e2e not run (lab unreachable).chore(flow): register Chrome extension assets in the public artifact …
fix(flow): extension secret check per attribute; real shadow event ta…
feat(flow): optional Chrome extension shadow-DOM evidence (Part of #1872
fix(flow): keep IPv6 brackets when stripping extension frame URLs (Pa…
abrichr commentedon Nov 6, 2026
Network-save slice: #2014 (Part of #1872). It adds
webRequestcapture of POST/PUT/PATCH/DELETE from tabs while recording, as redactednetwork_savelines inextension_evidence.jsonl. Redaction is fail-closed and runs in the extension and again on ingest: header values come only from an allowlist, Authorization/Cookie/Set-Cookie/token headers are always withheld, secrets are redacted in the URL and in JSON/form bodies, other bodies are dropped, and a record that still contains a withheld value is dropped. Real headless Chromium with the unpacked extension is covered. Deferred: response bodies, compiling saves into API steps, an installed native host e2e, and the store listing.test(flow): assemble synthetic network-save credentials at runtime (P…
fix(flow): keep complete withheld identity in both network-save redac…
fix(flow): track short known secrets in both network-save redactors (…
fix(flow): fullmatch extension id; fail when the service worker does …
fix(desktop): validate the whole Chrome extension id before registeri…
feat(flow): cross-origin iframe evidence for the optional Chrome exte…