Skip to content

docs: README permissions section and accuracy fixes #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harshabala merged 2 commits into from
Oct 11, 2026
Merged

docs: README permissions section and accuracy fixes #10

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a7add98
docs: Explain permissions and fix stale install/test notes in README
claude Oct 11, 2026
070e96d
docs: Tighten permission descriptions to match code
claude Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Heuristics run with no API key. An optional AI provider in Settings is a second
2. Unzip it.
3. Chrome → `chrome://extensions` → enable **Developer mode**.
4. **Load unpacked** → select the unzipped folder.
5. Open a new tab. Declare your intent. → set default policy → **Lock in** an intent.
5. Open a new tab and follow [First run](#first-run).

From source: clone this repo, load the repo folder unpacked, then `npm test`.

Expand All @@ -34,6 +34,16 @@ AI providers are not part of setup. Add one in **Settings** if you want a second
- No habit dashboard or rewards
- No Chrome Web Store listing yet (use the GitHub Release zip)

## Permissions

| Permission | Why |
|------------|-----|
| `storage` | Session, policy, settings and history stay in `chrome.storage` on this device; the optional AI key lives in session storage only |
| `tabs`, `tabGroups` | Read tab URLs to check them against your intent, and replace a tab with the lock page when the content script cannot run. `tabGroups` puts the session's tab in a group |
| `idle` | Detect when you are idle or the screen is locked so away time is not counted |
| `alarms` | Session time-budget expiry and hourly pruning of old history and diagnostics |
| Host access (`http://*/*`, `https://*/*`) | Inject the in-page lock overlay and dwell tracker on the pages you visit. Only origins are stored, never page text or titles |

## Privacy

See [docs/privacy-policy.md](docs/privacy-policy.md). Optional remote LLM providers receive minimized intent and origin-only context when you configure a key.
Expand Down Expand Up @@ -262,10 +272,10 @@ Key `chrome.storage.local` entries:
### Testing

```bash
npm test # all unit tests (358)
npm run verify:static # static/runtime/release checks (74)
npm test # all unit tests
npm run verify:static # static/runtime/release checks
node --test tests/heuristic-policy.test.mjs # one suite, e.g. the policy engine
npx playwright test # real-Chromium journeys + lifecycle (5)
npx playwright test # real-Chromium journeys + lifecycle (needs Playwright)
```

Unit tests use Node's built-in `node:test` + `assert/strict`, with no dependencies. The browser suite loads the unpacked extension in Chromium and covers two user journeys plus lifecycle cases: a real service-worker restart (lock and paused timer survive), the same URL in two tabs, and a real one-minute budget expiry. CI runs all three on every push and pull request.
Expand Down
Loading