chore: prepare v0.1.6 release surfaces

Author: abundantbeing

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v0.1.6 — 2026-06-28
+
+- Added built-in quick commands such as `/summarize`, `/explain`, `/rewrite`, `/tabs`, and `/action-items`, with slash dispatch and command suggestions in the side panel.
+- Added tab-context controls so Hermes can follow the active tab or pin to a specific tab.
+- Isolated pinned-tab conversations with per-tab local message caches and per-tab Hermes session bindings.
+- Added selected-tab filtering for the open-tabs context list, including all/none controls.
+- Added privacy redaction for sensitive tab titles/URLs before prompt assembly, including restricted active tabs and open-tab summaries.
+- Preserved contributor work from @iruzen-dono's quick-command and multi-tab context PRs, with follow-up hardening and tests.
+- Deferred the broad optional-host-permissions migration to a later release so v0.1.6 does not change the permission surface while shipping context-control improvements.
+
 ## v0.1.5 — 2026-06-27
 
 - Added a Hermes compatibility panel backed by `/v1/capabilities`, with legacy fallback when older gateways do not advertise feature support.

DATA-FLOW.md

@@ -1,6 +1,6 @@
 # Data Flow
 
-Hermes Browser Extension connects browser context to the Hermes Agent runtime you configure. This document describes the shipped v0.1.5 data flow.
+Hermes Browser Extension connects browser context to the Hermes Agent runtime you configure. This document describes the shipped v0.1.6 data flow.
 
 ## Connection modes
 
@@ -27,11 +27,11 @@ When remote mode has a dashboard URL and no API key, the extension uses the sign
 Depending on settings and page availability, a turn can include:
 
 - user message typed into the composer
-- active tab title and URL
+- active tab title and URL for the followed or pinned context tab
 - selected text
 - readable page text
 - page metadata, headings, form labels, links, buttons, and interactive element labels where available
-- open tab titles/URLs when “Include open tabs” is enabled
+- open tab titles/URLs when “Include open tabs” is enabled, or selected open-tab summaries when you use the tab picker
 - YouTube transcript text when a transcript provider is enabled and available
 - attached text files or metadata for non-text files
 - pasted/attached images as inline data, or as a local path when the connected Hermes runtime advertises image upload support
@@ -40,7 +40,7 @@ Depending on settings and page availability, a turn can include:
 
 ## What Hermes saw receipt
 
-v0.1.5 adds a collapsible “What Hermes saw” receipt after each sent turn. It summarizes:
+v0.1.6 includes a collapsible “What Hermes saw” receipt after each sent turn. It summarizes:
 
 - active tab
 - whether selected text was included
@@ -56,11 +56,13 @@ This receipt is for transparency and debugging. It is generated locally by the e
 
 Before page text is sent to Hermes, the extension redacts common secret/token shapes such as bearer tokens, provider API keys, private keys, GitHub tokens, Slack tokens, JWTs, and common `key=value` secret assignments.
 
+Before tab titles/URLs are included in the prompt, v0.1.6 redacts restricted categories such as browser internals, banking, crypto wallets, password managers, checkout/payment, health, and government tax/account pages.
+
 Browser page content is wrapped as untrusted context in the prompt. Hermes is instructed not to follow instructions from the page unless the human user explicitly asks.
 
 ## Capability detection
 
-The extension reads `/v1/capabilities` when available. If an older Hermes runtime does not expose that endpoint, v0.1.5 enters legacy compatibility mode:
+The extension reads `/v1/capabilities` when available. If an older Hermes runtime does not expose that endpoint, v0.1.6 enters legacy compatibility mode:
 
 - core chat/session features are attempted when the Gateway is connected and authenticated
 - browser-specific routes such as audio transcription, browser pairing, profile list, and image upload stay in fallback/manual mode unless advertised

PERMISSIONS.md

@@ -2,7 +2,7 @@
 
 Hermes Browser Extension is a Chrome/Edge/Chromium MV3 side panel for connecting the active browser page to your configured Hermes Agent runtime.
 
-This document describes the shipped v0.1.5 permission model.
+This document describes the shipped v0.1.6 permission model.
 
 ## Required extension permissions
 
@@ -18,7 +18,7 @@ This document describes the shipped v0.1.5 permission model.
 
 | Permission | Why it is optional |
 | --- | --- |
-| `audioCapture` | Requested only when voice dictation needs microphone capture from an extension page. If Hermes audio transcription is unavailable, v0.1.5 can use Browser speech fallback when Chromium exposes Web Speech. |
+| `audioCapture` | Requested only when voice dictation needs microphone capture from an extension page. If Hermes audio transcription is unavailable, v0.1.6 can use Browser speech fallback when Chromium exposes Web Speech. |
 
 ## Host permissions
 
@@ -35,14 +35,16 @@ The current alpha manifest includes:
 
 These host permissions let the side panel read context from normal web pages and connect to local or remote Hermes Gateway/API servers.
 
+v0.1.6 keeps this host-permission surface unchanged while adding tab pinning and sensitive-tab prompt redaction. A narrower optional-host-permissions migration is intentionally deferred until it can be shipped without breaking load-unpacked context capture.
+
 The extension still blocks browser-internal and sensitive categories in code, including:
 
 - `chrome://`, `edge://`, `devtools://`, extension pages, `file://`, and similar browser/internal schemes.
 - obvious banking, crypto wallet, password manager, checkout/payment, health, and government tax/account URLs.
 
 ## Permissions not requested
 
-Hermes Browser Extension v0.1.5 does **not** request:
+Hermes Browser Extension v0.1.6 does **not** request:
 
 - `debugger`
 - `nativeMessaging`

PRIVACY.md

@@ -2,11 +2,11 @@
 
 Hermes Browser Extension is a load-unpacked public alpha that sends browser context to the Hermes Agent runtime you configure.
 
-This document describes shipped v0.1.5 behavior.
+This document describes shipped v0.1.6 behavior.
 
 ## No analytics
 
-Hermes Browser Extension v0.1.5 does not include analytics, telemetry, ads, tracking pixels, or third-party reporting SDKs.
+Hermes Browser Extension v0.1.6 does not include analytics, telemetry, ads, tracking pixels, or third-party reporting SDKs.
 
 ## Local storage
 
@@ -18,6 +18,7 @@ The extension stores settings in `chrome.storage.local`, including:
 - context settings such as include-tabs/page-text/selected-text
 - appearance settings
 - local side-panel message history cache
+- per-tab local message caches and per-tab Hermes session bindings when you pin a browser tab
 
 Saved tokens are masked in the UI after save. The settings panel includes **Clear stored token** to remove the API key/browser token from extension storage.
 
@@ -34,6 +35,8 @@ The extension does not request or read:
 
 It reads page context from the active/current browser surface for the purpose of asking Hermes about what you are viewing.
 
+v0.1.6 can also pin the side panel to a specific tab. In pinned mode, the extension keeps that tab's local chat cache separate from the follow-active chat cache. Sensitive tab titles and URLs in restricted categories are redacted before prompt assembly.
+
 ## Local vs remote privacy boundary
 
 ### Local API mode
@@ -48,7 +51,7 @@ If you configure a remote Hermes URL, browser context is sent to that remote Her
 
 ## Voice privacy
 
-v0.1.5 supports two voice modes:
+v0.1.6 supports two voice modes:
 
 - **Hermes STT**: audio is captured in the extension page and sent once to the configured Hermes audio transcription endpoint when you stop recording.
 - **Browser speech fallback**: when Hermes STT is unavailable and Chromium exposes Web Speech, speech recognition runs in the browser and only transcript text is returned to the side panel.
@@ -59,7 +62,7 @@ No audio is intentionally saved by the voice dictation page.
 
 Text files can be included as text. Images can be included inline; when the connected Hermes runtime advertises image upload support, the extension can save image attachments through Hermes so the agent receives a local path-backed image reference.
 
-If image upload is unavailable, v0.1.5 keeps images inline and shows a fallback warning.
+If image upload is unavailable, v0.1.6 keeps images inline and shows a fallback warning.
 
 ## Remove extension data
 

README.md

@@ -33,6 +33,9 @@ This repo is specifically for the **Hermes Browser Extension**: the Chrome/Edge/
 - Auto-syncs connected Hermes providers/models, profiles, skills, sessions, and capabilities.
 - Shows a Hermes compatibility panel so older gateways degrade into explicit fallback/manual modes instead of broken route errors.
 - Sends active tab/browser context into a persisted Hermes session.
+- Adds follow/pin context controls so a side panel can stay locked to a specific browser tab.
+- Keeps pinned-tab conversations isolated with per-tab local history and Hermes session bindings.
+- Adds quick commands for common browser-context work, including `/summarize`, `/explain`, `/rewrite`, `/tabs`, and `/action-items`.
 - Adds a collapsible “What Hermes saw” receipt after each sent turn for transparent context/debugging.
 - Captures active tab title/URL, open tabs, selected text, readable page text, metadata, headings, forms, links, and buttons where available.
 - Supports voice dictation through Hermes audio transcription when available, with Browser speech fallback when the connected runtime does not expose STT.
@@ -197,16 +200,16 @@ See [`SECURITY.md`](SECURITY.md), [`PERMISSIONS.md`](PERMISSIONS.md), [`DATA-FLO
 
 Make sure you loaded `dist/`, not the repo root. The selected folder must contain `manifest.json` directly.
 
-### Chrome still shows version `0.1.4` after updating
+### Chrome still shows an older version after updating
 
-The browser is still using an old unpacked folder or an unpacked extension card that was not reloaded. The shipped v0.1.5 source, built `dist/`, and release archive all contain `manifest.json` version `0.1.5`.
+The browser is still using an old unpacked folder or an unpacked extension card that was not reloaded. The shipped v0.1.6 source, built `dist/`, and release archive all contain `manifest.json` version `0.1.6`.
 
 Fix:
 
-1. Extract/download the v0.1.5 release or run `npm run build` locally.
+1. Extract/download the v0.1.6 release or run `npm run build` locally.
 2. Open `chrome://extensions` or `edge://extensions`.
 3. On the Hermes Browser Extension card, click **Reload**.
-4. If it still says `0.1.4`, click **Remove**, then **Load unpacked** again and select the fresh v0.1.5 `dist/` folder.
+4. If it still shows an older version, click **Remove**, then **Load unpacked** again and select the fresh v0.1.6 `dist/` folder.
 5. Click **service worker** / **Inspect views** only for debugging; it is not the version source.
 
 ### The side panel says it cannot connect

SECURITY.md

@@ -1,6 +1,6 @@
 # Security Notes
 
-Hermes Browser Extension v0.1.5 is intentionally read-only.
+Hermes Browser Extension v0.1.6 is intentionally read-only.
 
 ## Current permission model
 
@@ -46,9 +46,11 @@ v0.1 refuses to read:
 
 This is a conservative first pass, not a complete security boundary.
 
+v0.1.6 also redacts sensitive tab titles and URLs before prompt assembly so restricted open tabs do not leak through the open-tabs summary or active-tab prompt fields.
+
 ## API key / browser token storage
 
-The Hermes API key/browser token is stored in `chrome.storage.local` for the extension. It is masked after save, and v0.1.5 includes **Clear stored token** in Settings.
+The Hermes API key/browser token is stored in `chrome.storage.local` for the extension. It is masked after save, and v0.1.6 includes **Clear stored token** in Settings.
 
 Do not publish screenshots or exported extension storage containing the key.
 

extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Hermes Browser Extension",
   "short_name": "Hermes Ext",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Browser-native side panel for Hermes Agent — connect web context to your local or remote Hermes runtime.",
   "minimum_chrome_version": "114",
   "icons": {

manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Hermes Browser Extension",
   "short_name": "Hermes Ext",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Browser-native side panel for Hermes Agent — connect web context to your local or remote Hermes runtime.",
   "minimum_chrome_version": "114",
   "icons": {

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "hermes-browser-extension",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": true,
   "description": "Browser-native side panel for Hermes Agent — connect web context to your local or remote Hermes runtime.",
   "type": "module",