feat: add persistent API mutation setting by alectimison-maker · Pull Request #2693 · webbrain-one/webbrain

alectimison-maker · 2026-08-07T02:30:25Z

Summary

add a default-off Always allow API mutations toggle under Settings → General → Advanced
persist and live-apply the setting in Chrome and Firefox while preserving /allow-api as an independent per-conversation override
keep the existing narrow write-method network boundary, update effective badge/model guidance, support config export/import, and document/localize the behavior

Motivation

/allow-api currently stores authorization only for the active tab conversation and clears it on /reset. Users who deliberately rely on API mutation fallbacks therefore have to repeat the command for every conversation and browser session. This implements the persistent opt-in requested in #2692 without changing the default security posture.

Design

The new alwaysAllowApiMutations storage boolean hydrates the Agent before first interactive, scheduled, or cloud runs and is applied immediately on storage changes. The Agent combines it with the existing per-tab apiAllowedTabs set through one effective-permission helper.

The two sources remain separate:

disabling the persistent setting revokes only global authorization and preserves an explicit /allow-api conversation override
/reset continues to clear the conversation override but does not alter the persistent setting
the side panel sends only the conversation override to the background, while its badge displays the effective global-or-conversation state

This avoids persisting tab IDs and avoids coupling authorization to the unrelated API mutation observer setting.

Testing

changed JavaScript files with node --check — passed
npm run test:toolbar-guard — 33/33 passed
npm run test:security — 60/60 passed
npm run test:webmcp — passed against Chrome 151 with Agent + CDP coverage
node test/run.js — all feature and regression tests passed; the suite still reports two pre-existing release-state failures: the changelog latest entry is 26.2.0 while package.json is 26.2.1, and dist/webbrain-chrome-26.2.1.zip is absent

npm run test:fixtures exercised both changed browser builds but was not fully available: two unrelated selection-dialog fixtures failed, then Playwright could not launch its missing Firefox 1511 executable (the reported setup remedy is npx playwright install).

Compatibility and risks

unset or non-boolean storage remains off; no migration is required
configuration export/import now carries the boolean with a false default
authorization still applies only to POST/PUT/PATCH/DELETE through fetch_url or research_url; GET egress, execute_js, submit confirmation, and other capability gates are unchanged
all supported UI locales include the new setting copy, with Chrome/Firefox parity

Scope

This does not change the API mutation observer, permission prompt defaults, release artifacts, or unrelated fixture behavior.

Closes #2692

vercel · 2026-08-07T02:30:29Z

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copilot

Pull request overview

Adds a persistent, default-off API mutation permission while preserving /allow-api as a per-conversation override.

Changes:

Adds persistent storage, live application, export/import, and effective permission handling.
Adds settings UI, badge updates, localization, documentation, and regression tests.
Updates model guidance for the combined authorization state.

Reviewed changes

Copilot reviewed 65 out of 69 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`test/run.js`	Tests persistence, browser parity, lifecycle, and execution.
`src/chrome/src/background.js`	Hydrates and live-applies the Chrome setting.
`src/chrome/src/config-transfer.js`	Adds configuration export/import support.
`src/chrome/src/agent/agent.js`	Combines persistent and conversation authorization.
`src/chrome/src/agent/planner.js`	Generalizes planner authorization guidance.
`src/chrome/src/agent/tools.js`	Updates Chrome tool policy guidance.
`src/chrome/src/ui/settings.js`	Loads and saves the Chrome toggle.
`src/chrome/src/ui/settings.html`	Adds the Chrome settings control.
`src/chrome/src/ui/sidepanel.js`	Displays effective Chrome authorization state.
`src/chrome/src/ui/locales/ar.js`	Adds Arabic setting copy.
`src/chrome/src/ui/locales/bn.js`	Adds Bengali setting copy.
`src/chrome/src/ui/locales/de.js`	Adds German setting copy.
`src/chrome/src/ui/locales/en.js`	Adds English setting copy.
`src/chrome/src/ui/locales/es.js`	Adds Spanish setting copy.
`src/chrome/src/ui/locales/fa.js`	Adds Persian setting copy.
`src/chrome/src/ui/locales/fr.js`	Adds French setting copy.
`src/chrome/src/ui/locales/he.js`	Adds Hebrew setting copy.
`src/chrome/src/ui/locales/hi.js`	Adds Hindi setting copy.
`src/chrome/src/ui/locales/id.js`	Adds Indonesian setting copy.
`src/chrome/src/ui/locales/ja.js`	Adds Japanese setting copy.
`src/chrome/src/ui/locales/ko.js`	Adds Korean setting copy.
`src/chrome/src/ui/locales/ms.js`	Adds Malay setting copy.
`src/chrome/src/ui/locales/nl.js`	Adds Dutch setting copy.
`src/chrome/src/ui/locales/pl.js`	Adds Polish setting copy.
`src/chrome/src/ui/locales/pt.js`	Adds Portuguese setting copy.
`src/chrome/src/ui/locales/ru.js`	Adds Russian setting copy.
`src/chrome/src/ui/locales/th.js`	Adds Thai setting copy.
`src/chrome/src/ui/locales/tl.js`	Adds Filipino setting copy.
`src/chrome/src/ui/locales/tr.js`	Adds Turkish setting copy.
`src/chrome/src/ui/locales/uk.js`	Adds Ukrainian setting copy.
`src/chrome/src/ui/locales/vi.js`	Adds Vietnamese setting copy.
`src/chrome/src/ui/locales/zh.js`	Adds Chinese setting copy.
`src/firefox/src/background.js`	Hydrates and live-applies the Firefox setting.
`src/firefox/src/config-transfer.js`	Adds configuration export/import support.
`src/firefox/src/agent/agent.js`	Combines persistent and conversation authorization.
`src/firefox/src/agent/planner.js`	Generalizes planner authorization guidance.
`src/firefox/src/agent/tools.js`	Updates Firefox tool policy guidance.
`src/firefox/src/ui/settings.js`	Loads and saves the Firefox toggle.
`src/firefox/src/ui/settings.html`	Adds the Firefox settings control.
`src/firefox/src/ui/sidepanel.js`	Displays effective Firefox authorization state.
`src/firefox/src/ui/locales/ar.js`	Adds Arabic setting copy.
`src/firefox/src/ui/locales/bn.js`	Adds Bengali setting copy.
`src/firefox/src/ui/locales/de.js`	Adds German setting copy.
`src/firefox/src/ui/locales/en.js`	Adds English setting copy.
`src/firefox/src/ui/locales/es.js`	Adds Spanish setting copy.
`src/firefox/src/ui/locales/fa.js`	Adds Persian setting copy.
`src/firefox/src/ui/locales/fr.js`	Adds French setting copy.
`src/firefox/src/ui/locales/he.js`	Adds Hebrew setting copy.
`src/firefox/src/ui/locales/hi.js`	Adds Hindi setting copy.
`src/firefox/src/ui/locales/id.js`	Adds Indonesian setting copy.
`src/firefox/src/ui/locales/ja.js`	Adds Japanese setting copy.
`src/firefox/src/ui/locales/ko.js`	Adds Korean setting copy.
`src/firefox/src/ui/locales/ms.js`	Adds Malay setting copy.
`src/firefox/src/ui/locales/nl.js`	Adds Dutch setting copy.
`src/firefox/src/ui/locales/pl.js`	Adds Polish setting copy.
`src/firefox/src/ui/locales/pt.js`	Adds Portuguese setting copy.
`src/firefox/src/ui/locales/ru.js`	Adds Russian setting copy.
`src/firefox/src/ui/locales/th.js`	Adds Thai setting copy.
`src/firefox/src/ui/locales/tl.js`	Adds Filipino setting copy.
`src/firefox/src/ui/locales/tr.js`	Adds Turkish setting copy.
`src/firefox/src/ui/locales/uk.js`	Adds Ukrainian setting copy.
`src/firefox/src/ui/locales/vi.js`	Adds Vietnamese setting copy.
`src/firefox/src/ui/locales/zh.js`	Adds Chinese setting copy.
`docs/slash-commands.md`	Documents persistent authorization behavior.
`docs/security-model.md`	Updates the security-boundary documentation.
`docs/fr/slash-commands.md`	Updates French command documentation.
`docs/fr/security-model.md`	Updates the French security model.
`docs/zh-CN/slash-commands.md`	Updates Chinese command documentation.
`docs/zh-CN/security-model.md`	Updates the Chinese security model.

Files not reviewed (4)

src/chrome/src/ui/locales/bn.js: Generated file
src/chrome/src/ui/locales/hi.js: Generated file
src/chrome/src/ui/locales/ru.js: Generated file
src/chrome/src/ui/locales/th.js: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.


+  setAlwaysAllowApiMutations(allowed) {
+    this.alwaysAllowApiMutations = allowed === true;
+    if (!this.alwaysAllowApiMutations) this.apiAllowedInjected.clear();


+              <div class="setting-label" data-i18n="st.display.always_allow_api_mutations.label"></div>
+              <div class="setting-desc" data-i18n="st.display.always_allow_api_mutations.desc"></div>
+            </div>
+            <label class="toggle">
+              <input type="checkbox" id="toggle-always-allow-api-mutations">


+              <div class="setting-label" data-i18n="st.display.always_allow_api_mutations.label"></div>
+              <div class="setting-desc" data-i18n="st.display.always_allow_api_mutations.desc"></div>
+            </div>
+            <label class="toggle">
+              <input type="checkbox" id="toggle-always-allow-api-mutations">



+  setAlwaysAllowApiMutations(allowed) {
+    this.alwaysAllowApiMutations = allowed === true;
+    if (!this.alwaysAllowApiMutations) this.apiAllowedInjected.clear();


feat: add persistent API mutation setting

a9fe8df

webbrain-one requested a balanced review from Copilot August 7, 2026 09:16

Copilot started reviewing on behalf of webbrain-one August 7, 2026 09:17 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

fix persistent API permission review findings

f66612a

esokullu merged commit 393942b into webbrain-one:main Aug 7, 2026
1 of 2 checks passed

Navigation Menu

Uh oh!

feat: add persistent API mutation setting - #2693

feat: add persistent API mutation setting#2693
esokullu merged 2 commits into
webbrain-one:mainfrom
alectimison-maker:feat/persistent-allow-api

alectimison-maker commented Aug 7, 2026

Uh oh!

vercel Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

alectimison-maker commented Aug 7, 2026

Summary

Motivation

Design

Testing

Compatibility and risks

Scope

Uh oh!

vercel Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants