From a7add98ba3a8988aec096f276f92c726b90d3ca3 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 14:54:49 +0530 Subject: [PATCH 1/2] docs: Explain permissions and fix stale install/test notes in README --- README.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index ab99590..dce2126 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Heuristics run with no API key. An optional AI provider in Settings is a second 2. Unzip it. 3. Chrome → `chrome://extensions` → enable **Developer mode**. 4. **Load unpacked** → select the unzipped folder. -5. Open a new tab. Declare your intent. → set default policy → **Lock in** an intent. +5. Open a new tab and follow [First run](#first-run). From source: clone this repo, load the repo folder unpacked, then `npm test`. @@ -34,6 +34,16 @@ AI providers are not part of setup. Add one in **Settings** if you want a second - No habit dashboard or rewards - No Chrome Web Store listing yet (use the GitHub Release zip) +## Permissions + +| Permission | Why | +|------------|-----| +| `storage` | Session, policy, settings and history stay in `chrome.storage` on this device; the optional AI key lives in session storage only | +| `tabs`, `tabGroups` | Read the active tab's URL to check it against your intent; group and replace tabs when locking | +| `idle` | Pause dwell tracking when you step away | +| `alarms` | Time budgets, pause timer and periodic pruning | +| Host access (`http://*/*`, `https://*/*`) | Inject the in-page lock overlay and dwell tracker on the pages you visit. Only origins are stored, never page text or titles | + ## Privacy See [docs/privacy-policy.md](docs/privacy-policy.md). Optional remote LLM providers receive minimized intent and origin-only context when you configure a key. @@ -262,10 +272,10 @@ Key `chrome.storage.local` entries: ### Testing ```bash -npm test # all unit tests (358) -npm run verify:static # static/runtime/release checks (74) +npm test # all unit tests +npm run verify:static # static/runtime/release checks node --test tests/heuristic-policy.test.mjs # one suite, e.g. the policy engine -npx playwright test # real-Chromium journeys + lifecycle (5) +npx playwright test # real-Chromium journeys + lifecycle (needs Playwright) ``` Unit tests use Node's built-in `node:test` + `assert/strict`, with no dependencies. The browser suite loads the unpacked extension in Chromium and covers two user journeys plus lifecycle cases: a real service-worker restart (lock and paused timer survive), the same URL in two tabs, and a real one-minute budget expiry. CI runs all three on every push and pull request. From 070e96d06c88dd8c486123a4c6c4dcb8d28001d2 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 14:55:08 +0530 Subject: [PATCH 2/2] docs: Tighten permission descriptions to match code --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index dce2126..0b0c493 100644 --- a/README.md +++ b/README.md @@ -39,9 +39,9 @@ AI providers are not part of setup. Add one in **Settings** if you want a second | Permission | Why | |------------|-----| | `storage` | Session, policy, settings and history stay in `chrome.storage` on this device; the optional AI key lives in session storage only | -| `tabs`, `tabGroups` | Read the active tab's URL to check it against your intent; group and replace tabs when locking | -| `idle` | Pause dwell tracking when you step away | -| `alarms` | Time budgets, pause timer and periodic pruning | +| `tabs`, `tabGroups` | Read tab URLs to check them against your intent, and replace a tab with the lock page when the content script cannot run. `tabGroups` puts the session's tab in a group | +| `idle` | Detect when you are idle or the screen is locked so away time is not counted | +| `alarms` | Session time-budget expiry and hourly pruning of old history and diagnostics | | Host access (`http://*/*`, `https://*/*`) | Inject the in-page lock overlay and dwell tracker on the pages you visit. Only origins are stored, never page text or titles | ## Privacy