## Summary
- Add `VITE_PUBLIC_KIMI_LAUNCH` feature flag controlling Kimi partnership branding
- BrowserOS provider card shows "Powered by Kimi K2.5 from Moonshot AI" badge and "Extended usage limits for the next 2 weeks!" when flag is on
- Moonshot/Kimi highlighted as "Recommended" in provider templates
- LLM Hub defaults to Kimi, ChatGPT, Claude, Gemini (with legacy defaults migration)
- Kimi hub row shows "Powered by Moonshot AI" flare
- Model selector locked to kimi-k2.5
- "How to get a Kimi API key" link in provider dialog
- Moonshot provider fully integrated across frontend and backend
* fix: refactor SDK BrowserService to use Browser class directly
The tools system was completely rewritten with new tool names and response
formats. BrowserService was calling non-existent MCP tools (browser_get_active_tab,
browser_navigate, etc.) that returned structuredContent which no longer exists.
Replaced MCP HTTP client calls with direct Browser class method calls:
- getActiveTab → browser.getActivePage() / browser.listPages()
- getPageContent → browser.contentAsMarkdown()
- getScreenshot → browser.screenshot()
- navigate → browser.goto() with tabId/windowId resolution
- getPageLoadStatus → browser.listPages() with isLoading check
- getInteractiveElements → browser.snapshot() / browser.enhancedSnapshot()
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review — consistent tabId guard and remove dead PageContent type
- Change `if (tabId)` to `if (tabId !== undefined)` in navigate() to match
the guard style used for windowId and elsewhere in the file
- Remove orphaned PageContent interface no longer imported after refactor
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
SIGQUIT (Ctrl+\) was not in the signal notify list, causing Go's default
handler to dump goroutines. On macOS ARM64 this triggers a known runtime
bug where semasleep panics on the signal stack.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add "don't show again" checkbox to JTBD survey popup
Mirrors the ImportDataHint pattern — adds a checkbox that permanently
suppresses the survey popup when checked and dismissed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: persist dontShowAgain when user clicks Take Survey
Addresses Greptile review — if the checkbox is checked and the user
clicks "Take Survey", persist the flag before opening the survey so
the popup won't reappear if the survey tab is closed without starting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: show "don't show again" only after 2nd popup, increase interval to 10 msgs
- Track shownCount in storage, only show checkbox on 3rd+ appearance
- Increase MESSAGE_THRESHOLD from 5 to 10 messages between popups
- Add DONT_SHOW_AGAIN_AFTER constant (2) for configurability
- Pass showDontShowAgain through the component chain
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: thread dontShowAgain through onTakeSurvey to avoid duplicate analytics
Addresses Greptile review — previously clicking "Take Survey" with the
checkbox checked would fire both dismissed and clicked events. Now the
dontShowAgain flag is threaded through onTakeSurvey, which persists it
without firing a dismiss event.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The --new flag creates a fresh temp profile directory but WXT's
chromiumProfile was hardcoded to /tmp/browseros-dev, ignoring it.
Pass BROWSEROS_USER_DATA_DIR env var from the Go dev tool and read
it in web-ext.config.ts.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: filter out messages with empty parts to prevent follow-up crash
When an assistant response is interrupted or errors before producing content,
a UIMessage with empty parts remains in the chat state. On the next send, the
AI SDK validates all messages and rejects the empty-parts message with
"Message must contain at least one part". This filters them out when not
streaming and adds a safety guard in formatConversationHistory.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: filter empty-parts messages before persisting to storage
Addresses race condition where the save effect could persist messages
with empty parts before the cleanup effect's state update applies.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: limit claude code review to PR creation and @claude comments
Reduces unnecessary action runs and token usage by only triggering the
review on initial PR open, and re-running when @claude is mentioned.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restrict @claude trigger to trusted contributors
Only repo owners, org members, and collaborators can invoke the review
via @claude comments, preventing external users from consuming token quota.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: consolidate claude workflows and auto-run on PR creation
Remove separate claude-code-review.yml and add pull_request trigger
to claude.yml so it runs automatically on PR open without needing
@claude in the body.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore author_association guard on issue_comment trigger
The consolidation commit dropped the author_association check from the
issue_comment condition. Without it, any external commenter could invoke
Claude and consume token quota. Restores the guard to limit triggers to
OWNER, MEMBER, and COLLABORATOR.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: apply author_association guard to review comment triggers
Extends the OWNER/MEMBER/COLLABORATOR check to pull_request_review_comment
and pull_request_review events, preventing external users from triggering
Claude via review comments.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: gate previousConversation array format behind BrowserOS 0.41.0.0
Older servers reject the array format for previousConversation with a
ZodError ("Expected string, received array"). Gate the feature behind
BrowserOS >= 0.41.0.0 which bundles server >= 0.0.64 that accepts both
array and string formats.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use minServerVersion 0.0.64 for previousConversation gate
Server version is the direct indicator of schema support, more accurate
than using BrowserOS version as a proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fall back to string format for previousConversation on old servers
Instead of omitting previousConversation entirely on servers < 0.0.64,
serialize the conversation history as a "role: content" string which
old servers accept via their z.string() schema.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* chore: bump PATCH and OFFSET
* fix: add AppArmor profile and improve .deb packaging for Ubuntu 23.10+
Ship an AppArmor profile with the .deb package that grants the
`userns` permission, fixing the fatal sandbox crash on Ubuntu 23.10+
and other distros that restrict unprivileged user namespaces via
AppArmor (closes#165).
Also adds: Qt5/Qt6 shim libraries for native file dialogs on KDE,
update-alternatives registration for default browser selection,
prerm cleanup script, and Provides/Recommends metadata.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct CDN download path for .deb and add multi-size icons
Update .deb download path from lowercase "browseros.deb" to "BrowserOS.deb"
to match the URL advertised in README (cdn.browseros.com/download/BrowserOS.deb).
Also install icons at all available sizes instead of only 256x256.
Closes#368
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add multi-size icons and AppStream metainfo to .deb package
Install product icons at all standard hicolor sizes (16, 22, 24, 32,
48, 64, 128, 256) instead of only 256px, so desktop environments can
pick the appropriate resolution for panels, menus, and task switchers.
Ship AppStream metainfo at /usr/share/metainfo/browseros.metainfo.xml
so GNOME Software, KDE Discover, and other software centers can
discover and display BrowserOS in their catalogs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: guard postinst update-alternatives with $1=configure check
Matches prerm's pattern — only register alternatives during normal
configure, not during dpkg error-recovery paths (abort-upgrade, etc.)
where /usr/bin/browseros may not exist yet.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add bun binary signing for macOS and Windows
Register the bun runtime binary in the code signing pipelines so it gets
properly signed and notarized alongside browseros_server and codex.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add bun runtime download and copy resource configs
Add bun binary entries for all platform/arch combos (macOS arm64/x64,
Linux arm64/x64, Windows x64) to download from R2 and copy into the
Chromium build output alongside browseros_server.
Also adds the server bundle (index.js) download and copy entries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add get_dom and search_dom tools for HTML DOM inspection
Add two new observation tools:
- get_dom: Returns raw HTML of a page or scoped element via CSS selector
- search_dom: Fuzzy searches DOM elements by text, attributes, IDs, and
class names using Fuse.js with extended search syntax support
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: use CDP DOM protocol instead of injected scripts for DOM tools
Replace Runtime.evaluate-based approach with native CDP DOM methods:
- get_dom uses DOM.getDocument + DOM.querySelector + DOM.getOuterHTML
- search_dom uses DOM.performSearch + DOM.getSearchResults + DOM.describeNode
- Remove fuse.js dependency (CDP performSearch handles text/CSS/XPath natively)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add comprehensive tests for get_dom and search_dom tools
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve text nodes to parent elements in searchDom
CDP performSearch returns text nodes (nodeType 3) for plain text queries.
describeNode does not populate parentId, so use resolveNode + callFunctionOn
to get parentElement, then requestNode to obtain the parent's nodeId.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add limit bounds validation and searchId leak prevention
- Add .int().min(1).max(200) to search_dom limit parameter
- Wrap searchDom result processing in try/finally to ensure
discardSearchResults is always called
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Tests were passing raw Chrome tabIds to group_tabs and ungroup_tabs tools,
but the Zod schemas expect pageIds (MCP-layer page IDs). The tabIds field
was silently stripped during validation, causing both tests to fail.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add new CDP tools for links, hidden pages/windows, show/move
- get_page_links: extract deduplicated links from a page via evaluate
- new_hidden_page: open a hidden tab for background automation
- create_hidden_window: create a hidden window for background automation
- show_page: restore a hidden page back into a visible window
- move_page: move a tab to a different window or position
- Default includeLinks to false in get_page_content
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: use AX tree for get_page_links, add tests, fix test scripts
- Refactor get_page_links to use accessibility tree instead of raw JS
evaluate — more reliable for role="link" elements and shadow DOM
- Add extractLinkNodes() to snapshot.ts and getPageLinks() to browser.ts
- Add tests for get_page_links (constructed HTML with dedup/filtering),
new_hidden_page, show_page, move_page, create_hidden_window
- Fix root package.json test scripts to match server's actual scripts
- Update CLAUDE.md test docs to reflect current structure
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: move ChatV2Service to api/services layer and add resolvePageIds
Move ChatV2Service from agent/tool-loop/ to api/services/ where it
belongs as a service-layer concern. Add resolvePageIds() to convert
Chrome tab IDs to internal page IDs before they reach the agent,
fixing undefined pageId issues in browser automation tools.
Clean up server.ts by removing the USE_TOOL_AGENT flag, SessionManager,
and old chat route import — both /chat and /chat-v2 now directly use
createChatV2Routes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address review comments for chat-v2-service
- Fix TOCTOU race: derive isNewSession inside the creation block
instead of separate has()/get() calls
- Log warning when resolvePageIds can't map a tab ID
- Deduplicate tab IDs with Set before resolving
- Remove redundant null check on session in onFinish
- Add license header
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update bun.lock
* fix: skip resolvePageIds for scheduled tasks to prevent pageId corruption
Scheduled tasks build browserContext with internal page IDs from
browser.newPage(), not Chrome tab IDs. The unconditional second
resolvePageIds() call was passing these internal IDs to resolveTabIds()
which expects Chrome tab IDs, causing the lookup to fail and overwrite
correct pageIds with undefined.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add biome-ignore comments for noExcessiveCognitiveComplexity on compaction.ts
and grep.ts, and noExplicitAny on filesystem test helpers.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: generalized compaction prompts with split turn handling
Replace browser-specific XML prompts with domain-agnostic markdown format.
Add split turn detection and parallel summarization for large single-turn
conversations. Switch compaction from generateText to streamText for
Fireworks API compatibility. Add comprehensive unit and E2E tests (84 total).
* fix: address code review issues for compaction (PR #391)
Enforce COMPACTION_MAX_SUMMARIZATION_INPUT cap, extract shared
callSummarizer helper, add runtime type guard for experimental_context,
move magic constants to AGENT_LIMITS, and remove dead constants.
* fix: cap truncatedTurnPrefix input to maxSummarizationInput
Apply the same sliding window cap to turn prefix messages that was
already applied to toSummarize, preventing unbounded LLM input for
long single-turn conversations with many tool calls.
* fix: reduce browseros-auto default context window to 200K
The 400K setting caused compaction to trigger at ~383K, but the actual
model limit is 262K. Conversations hit the hard limit before compaction
could kick in.
* feat: replace flaky TypeScript dev:watch with Go CLI (devwatch)
The Bun-based scripts/dev/start.ts orchestrator had fundamental issues with
WXT when launched via `bun run --filter` with cwd manipulation. This replaces
it with a Go CLI at tools/devwatch/ that provides:
- Process supervision with auto-restart on crash
- Colored log streaming with [tag] prefixes
- Automatic port discovery (--new flag)
- Fresh user-data directory creation
- Process group management for clean shutdown (SIGTERM → SIGKILL escalation)
- CDP readiness polling before starting the server
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: run agent codegen before wxt and add force-kill on double Ctrl+C
- Run graphql-codegen if generated/graphql/ doesn't exist, matching the
agent's own `dev` script behavior
- Second Ctrl+C sends SIGKILL to all process groups and exits immediately,
so you're never stuck in a restart loop
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add run.sh wrapper that checks for Go and prompts to install
If Go isn't installed, shows a clear message with install instructions
(brew install go / go.dev/dl). Also skips rebuilding if the binary
already exists and main.go hasn't changed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: show double Ctrl+C hint at startup
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: swap ANSI escape codes for fatih/color
Adds proper TTY detection, NO_COLOR env var support, and cleaner
color API. Also improves help output with bold/dim styling.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: restructure devwatch into browseros-dev CLI with cobra subcommands
Expands the single-file devwatch into a modular CLI with three subcommands:
- `watch` — dev environment with process supervision (port of devwatch)
- `test` — start test env, run bun test, clean up (replaces TS test helpers)
- `cleanup` — kill ports + remove orphaned temp dirs (replaces cleanup.sh)
Shared Go packages for browser lifecycle (CDP polling, arg building),
server health checks (health + extension status), and process management
(managed proc, port killing, streaming, monorepo root finding).
Fixes PR #389 feedback:
- Add timeout after SIGKILL in Stop() to prevent indefinite hang
- Fix run.sh freshness check to detect changes in all .go files
- Add double Ctrl+C force-kill to test command
- Guard test cleanup with sync.Once to prevent race condition
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: replace run.sh freshness logic with Makefile
Make handles timestamp-based dependency tracking natively. The Makefile
rebuilds only when any .go file, go.mod, or go.sum is newer than the
binary. run.sh just checks for Go, calls make, and execs the binary.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
