feat: release Hermes Browser Extension v0.2.0

Ship Hermes Assist, Browser Context Protocol v2, live task stacks, exact model routing, canonical model discovery, hardened session readiness, and release-grade Chromium/Firefox packaging.

Author: abundantbeing

CHANGELOG.md

@@ -2,10 +2,42 @@
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-07-21
+
+### Added
+
+- Added **Hermes Assist**, a review-first inline drafting surface for 31 supported writing environments including X, GitHub, Gmail, ChatGPT, Claude, Reddit, Slack, Discord, Outlook, Google Chat, and Atlassian surfaces.
+- Added site- and composer-aware primary actions such as **Draft a reply**, **Draft a post**, and **Draft a message**, while retaining useful site-specific secondary actions.
+- Added explicit current-session, new-session, and background-session routing for Hermes Assist and context-menu actions.
+- Added per-site context controls with private-surface defaults, visible context warnings, bounded extraction, and copy-only fallbacks for framework-owned structured editors.
+- Added capability-gated model routing for Hermes Assist: gateways that advertise per-session model locking receive the exact selected provider/model and must acknowledge it; released gateways without that contract use the active Hermes Agent model without sending unsupported override fields.
+- Added deterministic local text utilities for formatting cleanup, bullets, text statistics, and diffs without a model call.
+- Added Browser Context Protocol v2 turn envelopes and owner/session/turn-scoped companion context storage with bounded retention and consume-on-read isolation.
+
+### Changed
+
+- Unified Local, Hermes Cloud Preview, and Remote readiness behind one staged connection controller that does not report ready until its required session-binding gate passes.
+- Kept automatic API pairing loopback-only. Remote API connections now require an explicitly configured endpoint and token; dashboard connections continue to use Trusted Dashboard Attach.
+- Made non-loopback agent discovery permanently credential-free, even when a probed service self-identifies as Hermes.
+- Made rich structured editors preview/copy-first by default; safe direct apply remains limited to reviewed, supported composer integrations.
+- Added exact target-specific Chromium and Firefox release packaging with versioned archives, SHA-256 checksums, and a machine-readable release manifest.
+
+### Security
+
+- Bound browser context to typed turns with owner, conversation, session, and turn identity; enforced TTL, size, redirect, URL-scheme, and redaction limits at trust boundaries.
+- Kept Cloud/dashboard tickets short-lived, single-use, memory-only, HTTPS-only, and bound to the exact active signed-in tab and origin.
+- Prevented stored bearer credentials from being released during non-loopback discovery and prevented automatic pairing with non-loopback API endpoints.
+- Preserved Chat-only enforcement for Cloud and ticketed dashboard transports.
+
 ### Fixed
 
+- Fixed X reply context capture so Hermes receives the source post instead of an empty inner reply form.
+- Fixed X draft insertion to use one framework-owned paste transaction, preventing duplicate or undeletable ghost text.
+- De-duplicated inline result application by request id so retries cannot apply the same draft twice.
+- Contained keyboard events inside Hermes Assist so host-page shortcuts cannot steal focus, navigate, or react while a user types a custom instruction.
 - Preserved remote dashboard conversations across WebSocket replacement by persisting the gateway's durable session identity, resuming it on reconnect, and routing follow-up RPCs through the fresh live session identity.
 - Made Chrome 141+ require a real `sidePanel.onOpened` event so Arc's hidden `SIDE_PANEL` contexts cannot suppress the reusable extension-tab fallback, while retaining context confirmation for Chrome 116-140.
+- Corrected GPT-5.6 context metadata by provider: OpenAI Codex OAuth models now show the canonical 272k window, direct OpenAI models retain 1.05M, explicit runtime/catalog telemetry remains authoritative, and rows without provider identity no longer inherit the generic 400k GPT-5 guess.
 
 ### Contributors
 

DATA-FLOW.md

@@ -1,6 +1,6 @@
 # Data Flow
 
-Hermes Browser Extension connects browser context to the Hermes Agent runtime you configure. This document describes the shipped v0.1.11 data flow.
+Hermes Browser Extension connects browser context to the Hermes Agent runtime you configure. This document describes the shipped v0.2.0 data flow.
 
 ## Connection modes
 
@@ -14,6 +14,10 @@ http://127.0.0.1:8642
 
 In local mode, context is sent from the extension to the Hermes Gateway/API server running on the same machine.
 
+### Hermes Cloud Preview
+
+Cloud Preview requires the exact active, fully loaded, signed-in HTTPS Hermes agent tab. That tab mints a short-lived single-use WebSocket ticket, the extension revalidates the tab and origin, and the ticket stays memory-only. Cloud Preview is Chat-only: page text, selected text, open-tab context, and attachments are not sent through this transport.
+
 ### Remote Hermes API
 
 When you configure a remote Gateway URL and API key/browser token, context is sent to that remote Hermes API server. Same-LAN or private VPN hosts can use `http://host:8642`; public/proxied hosts should use `https://`. Set `API_SERVER_ENABLED=true`, `API_SERVER_HOST=0.0.0.0`, `API_SERVER_KEY`, and a narrow `API_SERVER_CORS_ORIGINS=chrome-extension://<extension-id>` on the Hermes host. Do not expose a Hermes API server naked to the public internet.
@@ -37,20 +41,27 @@ Depending on context scope, settings, and page availability, a turn can include:
 - pasted/attached images as inline data, or as a local path when the connected Hermes runtime advertises image upload support
 - voice transcript text from Hermes STT or Browser speech fallback
 - selected model/session/profile/settings metadata needed to route the request
+- for a model-backed Hermes Assist action: the current draft plus only the bounded site context enabled for that site
 
 If you choose **Chat only**, the extension sends your message without active tab title/URL, open tabs, selected text, page metadata, YouTube transcript, or page text.
 
+## Hermes Assist review/apply flow
+
+Hermes Assist identifies the focused composer and builds a bounded draft request. The request is sent through the chosen current/new/background session route. If the gateway advertises per-session model locking, Hermes Assist sends the exact selected provider/model and fails closed on a mismatch. Released gateways without that contract receive no provider/model override and use the active model configured in Hermes Agent.
+
+The result returns to a local review panel. The user can copy it or explicitly apply it to a supported focused composer. Structured editors default to preview/copy unless their adapter has a verified safe apply path. Applying never submits the form or message. Deterministic formatting, bullets, statistics, and diff actions run locally and do not enter this network flow.
+
 ## Hermes Web full view
 
 Hermes Web uses the same configured Local or Remote API connection and canonical Hermes session history as the side panel. It loads sessions, models, skills, runtime options, generated media, and persisted context telemetry from the configured Hermes gateway. Opening full view does not grant browser-control permissions. Hermes Cloud/dashboard-ticket full-view history remains read-only until a shared ticketed WebSocket coordinator owns that connection.
 
 ## Browser Context Protocol and optional companion cache
 
-v0.1.11 keeps the prompt-embedded Browser Context Protocol fallback and can also expose sanitized context metadata to the optional companion plugin. The plugin cache is process-local and stores safe metadata such as protocol id, payload hash, context scope, active-tab origin, section availability/counts, redaction count, and event-log diagnostics. It does not store raw page text, selected text, full tab URLs, cookies, tokens, or browser-control channels.
+v0.2.0 emits typed Browser Context Protocol v2 turn envelopes with owner/conversation/session/turn identity while retaining the prompt-embedded v1 compatibility path. It can also expose sanitized context metadata to the optional companion plugin. The plugin cache is process-local, owner-scoped, TTL-bounded, and consume-on-read. It stores safe metadata such as protocol id, payload hash, context scope, active-tab origin, section availability/counts, redaction count, and bounded event diagnostics. It does not store raw page text, selected text, full tab URLs, cookies, tokens, or browser-control channels.
 
 ## What Hermes saw receipt
 
-v0.1.11 includes a collapsible “What Hermes saw” receipt after each sent turn. It summarizes:
+v0.2.0 includes a collapsible “What Hermes saw” receipt after each sent turn. It summarizes:
 
 - context scope, including Chat only when no browser context was attached
 - active tab
@@ -66,24 +77,24 @@ This receipt is for transparency and debugging. It is generated locally by the e
 
 ## Tool activity while streaming
 
-When Hermes reports a tool call during a streaming turn, v0.1.11 renders it as an in-message Tool Activity Strip with a sanitized short preview. Tool names and previews are generated locally from normalized runtime events; sensitive token shapes are redacted before display. Tool activity is UI state only and is not extra browser context sent to Hermes.
+When Hermes reports a tool call during a streaming turn, v0.2.0 renders it as an in-message Tool Activity Strip with a sanitized short preview. Tool names and previews are generated locally from normalized runtime events; sensitive token shapes are redacted before display. Tool activity is UI state only and is not extra browser context sent to Hermes.
 
 ## Redaction and untrusted context
 
 Before page text is sent to Hermes, the extension redacts common secret/token shapes such as bearer tokens, provider API keys, private keys, GitHub tokens, Slack tokens, JWTs, and common `key=value` secret assignments.
 
-Before tab titles/URLs are included in the prompt, v0.1.11 redacts restricted categories such as browser internals, banking, crypto wallets, password managers, checkout/payment, health, and government tax/account pages. It also decodes and blocks credential-bearing query/hash parameters—including nested encodings and common signed-URL credentials/signatures—across active, selected, open-tab, pinned-scope, prompt, receipt, and payload-hash surfaces.
+Before tab titles/URLs are included in the prompt, v0.2.0 redacts restricted categories such as browser internals, banking, crypto wallets, password managers, checkout/payment, health, and government tax/account pages. It also decodes and blocks credential-bearing query/hash parameters—including nested encodings and common signed-URL credentials/signatures—across active, selected, open-tab, pinned-scope, prompt, receipt, and payload-hash surfaces.
 
 Browser page content is wrapped as untrusted context in the prompt. Hermes is instructed not to follow instructions from the page unless the human user explicitly asks.
 
 ## Capability detection
 
-The extension reads `/v1/capabilities` when available. If an older Hermes runtime does not expose that endpoint, v0.1.11 enters legacy compatibility mode:
+The extension reads `/v1/capabilities` when available. If an older Hermes runtime does not expose that endpoint, v0.2.0 enters legacy compatibility mode:
 
 - core chat/session features are attempted when the Gateway is connected and authenticated
 - browser-specific routes such as audio transcription, browser pairing, profile list, and image upload stay in fallback/manual mode unless advertised
 
-v0.1.11 also separates gateway reachability from upstream Hermes runtime/tool tracebacks. If the API server is reachable but an upstream Hermes tool/runtime raises a Python traceback, the side panel can show a connected-with-warning diagnostic instead of treating the whole Browser connection as broken. Settings also include Copy Diagnostics, which creates a redacted support block without API keys, bearer tokens, cookies, page text, selected text, tab titles, or full tab URLs.
+v0.2.0 also separates gateway reachability from upstream Hermes runtime/tool tracebacks. If the API server is reachable but an upstream Hermes tool/runtime raises a Python traceback, the side panel can show a connected-with-warning diagnostic instead of treating the whole Browser connection as broken. Settings also include Copy Diagnostics, which creates a redacted support block without API keys, bearer tokens, cookies, page text, selected text, tab titles, or full tab URLs.
 
 ## Related docs
 

PERMISSIONS.md

@@ -2,15 +2,15 @@
 
 Hermes Browser Extension is a Chrome/Edge/Chromium MV3 side panel for connecting the active browser page to your configured Hermes Agent runtime.
 
-This document describes the shipped v0.1.11 permission model.
+This document describes the shipped v0.2.0 permission model.
 
 ## Required extension permissions
 
 | Permission | Why it is needed |
 | --- | --- |
 | `activeTab` | Lets the extension inspect the currently active tab after the user opens/uses the side panel. |
 | `downloads` | Saves generated images or artifacts only after the user explicitly chooses Download. It is not used to inspect download history. |
-| `scripting` | Lets the extension inject its read-only context collector into normal `http://` and `https://` pages when the content script is missing/stale. |
+| `scripting` | Lets the extension inject its bounded context collector and Hermes Assist runtime into normal `http://` and `https://` pages when the content script is missing/stale. |
 | `sidePanel` | Provides the browser side-panel UI. |
 | `storage` | Stores local extension settings such as Gateway URL, selected session/model/profile, appearance, and the saved API key/browser token. |
 | `tabs` | Reads tab titles/URLs for the active-tab state, context refreshes, tab summaries, and remote dashboard WebSocket ticket flow. |
@@ -19,7 +19,7 @@ This document describes the shipped v0.1.11 permission model.
 
 | Permission | Why it is optional |
 | --- | --- |
-| `audioCapture` | Requested only when voice dictation needs microphone capture from an extension page. If Hermes audio transcription is unavailable, v0.1.11 can use Browser speech fallback when Chromium exposes Web Speech. |
+| `audioCapture` | Requested only when voice dictation needs microphone capture from an extension page. If Hermes audio transcription is unavailable, v0.2.0 can use Browser speech fallback when Chromium exposes Web Speech. |
 
 ## Host permissions
 
@@ -36,7 +36,7 @@ The current alpha manifest includes:
 
 These host permissions let the side panel read context from normal web pages and connect to local or remote Hermes Gateway/API servers.
 
-v0.1.11 keeps this host-permission surface unchanged while adding Hermes Web, runtime visibility, connected-with-warning diagnostics, and redacted Copy Diagnostics support reports. A narrower optional-host-permissions migration is intentionally deferred until it can be shipped without breaking load-unpacked context capture.
+v0.2.0 keeps this host-permission surface unchanged while adding site-aware Hermes Assist, typed context delivery, Hermes Web, runtime visibility, and redacted Copy Diagnostics support reports. A narrower optional-host-permissions migration is intentionally deferred until it can be shipped without breaking load-unpacked context capture.
 
 The extension still blocks browser-internal and sensitive categories in code, including:
 
@@ -45,16 +45,16 @@ The extension still blocks browser-internal and sensitive categories in code, in
 
 ## Permissions not requested
 
-Hermes Browser Extension v0.1.11 does **not** request:
+Hermes Browser Extension v0.2.0 does **not** request:
 
 - `debugger`
 - `nativeMessaging`
 - `cookies`
 - `history`
 - `bookmarks`
-- browser-control permissions for click/type/form-submit automation
+- browser-control permissions for autonomous click/type/form-submit automation
 
-It is read-only in the browser: it collects context and sends prompts to Hermes; it does not click, type, submit forms, buy things, delete things, or control pages.
+Browser context collection remains read-only. Hermes Assist can insert reviewed text into the currently focused supported composer only after an explicit user action; it never clicks Send/Post/Submit, navigates, buys, deletes, or autonomously controls pages. This constrained apply path uses the existing page script and does not add `debugger` or broad browser-control permissions.
 
 ## Related docs