Add trusted-local Autopilot policy profiles

CHANGELOG.md

@@ -1,7 +1,8 @@
 # Changelog
 
 ## Unreleased
-- Replaced the Chrome Bridge v1 runtime with the AgentTab 2.0 release candidate: a Rust production host over OS-native local IPC, seven task-scoped Standard methods, explicit resumable capabilities, a developer-only eighth method, TypeScript and Python SDKs, MCP and OMP adapters, a transactional installer, and a minimal extension. Consequential controls now use a two-party Commit flow: `browser_act` stages an exact effect, the popup approves the durable review record without executing it, and the requesting task must consume its private one-use token through `browser_commit`.
+- Replaced the Chrome Bridge v1 runtime with the AgentTab 2.0 release candidate: a Rust production host over OS-native local IPC, seven task-scoped Standard methods, explicit resumable capabilities, a developer-only eighth method, TypeScript and Python SDKs, MCP and OMP adapters, a transactional installer, and a minimal extension. Fresh extension state starts in unattended Autopilot; existing pre-policy state migrates to Strict to preserve former Commit behavior. Review selected and Strict use a two-party Commit flow in which `browser_act` stages an exact effect, the popup approves the durable review record without executing it, and the requesting task must consume its private one-use token through `browser_commit`.
+- Added extension-local persistent Autopilot, Review selected, and Strict action-policy profiles, remembered effect-category approvals scoped to a task, HTTP(S) origin, or all sites, and an idempotent `agenttab policy allow-upload PATH` command for the separate host upload-root policy. Pause is now only a logical admission toggle, while `scripting` joins `debugger` as an install-time permission so unattended work does not stop on a runtime grant prompt. Sensitive password, passkey, OTP, CAPTCHA, and payment fields still require Your Turn in every profile.
 - Added task-owned background window creation to Standard `browser_open` through `placement: "new_window"`. It is operation-specific rather than a general window-control grant: only an otherwise empty task can request it, the extension creates an unfocused normal window, `background: false` is rejected, ownership is derived from persisted task state, and a failed visible group grant removes the new tab. Focus, state changes, and closure of unrelated windows remain unavailable.
 - Added explicit restricted-origin routing for task tabs. `browser_open` and `browser_tabs` now report `automation_route: "full" | "tab_only"`; Chrome system pages, extension pages, DevTools, and the Chrome Web Store retain task-owned explicit navigation, reload, close, and bounded waits, while page inspection, interaction, and raw CDP fail before execution with the stable `browser_restricted_origin` / `not_started` result and non-retry recovery. History movement remains available without managed origin constraints and fails closed when constraints are configured because Chrome does not expose its destination for pre-navigation authorization.
 - Migrated the Python MCP server to SDK 2.0 and the `2026-07-28` protocol while preserving legacy stdio compatibility, scoped tool registration, resources, annotations, per-request HTTP bridge tokens, and streamable HTTP configuration.

README.md

@@ -6,7 +6,7 @@
 
 > Give an agent a tab, not the keys to your browser.
 
-AgentTab lets an agent work in your existing signed-in Chrome profile without giving it unrestricted control of the profile. Each connection receives a task-owned browser workspace. The agent can create tabs, inspect and act in those tabs, wait for page state, and ask for help. Passwords, passkeys, 2FA, CAPTCHA, payment secrets, and other human-only input belong to **Your Turn**. Recognizable consequential actions are staged for **Commit** instead of being performed immediately.
+AgentTab lets an agent work in your existing signed-in Chrome profile without giving it unrestricted control of the profile. Each connection receives a task-owned browser workspace. The agent can create tabs, inspect and act in those tabs, wait for page state, and ask for help. Passwords, passkeys, 2FA, CAPTCHA, payment secrets, and other human-only input belong to **Your Turn**. Fresh installs start in **Autopilot** to avoid unattended Commit prompts; existing pre-policy state upgrades to Strict so former Commit behavior is preserved. Review selected and Strict can stage recognizable effects for **Commit**.
 
 ## Release status
 
@@ -25,18 +25,18 @@ The command has no path, token, or shell-specific argument and is suitable for P
 1. An agent calls `browser_open` with `mode: "create"`. AgentTab creates a background tab for that task and returns its task, tab, window, page-revision, and automation-route identifiers. `placement: "new_window"` may create the task's first tab in a separate unfocused normal window.
 2. On a normal web origin, the agent calls `browser_snapshot`, works from revisioned accessibility references, then calls `browser_act` with the expected page revision. It cannot act on unrelated tabs.
 3. If a site requires human-only input, the agent calls `browser_handoff`. AgentTab focuses that tab, pauses automation, and blocks browser observation until the declared completion condition or **I'm done**.
-4. If AgentTab recognizes a send, publish, purchase, delete, upload, authorization, or permission-grant control, `browser_act` can return `commit_required`. The extension shows the staged effect in its popup. A human must approve it there before the agent can call `browser_commit` with the one-use staged token.
+4. Under Review selected or Strict, if AgentTab recognizes a send, publish, purchase, delete, upload, authorization, or permission-grant control, `browser_act` can return `commit_required`. The extension shows the staged effect in its popup. A human must approve it there before the agent can call `browser_commit` with the one-use staged token. Autopilot executes recognized effects directly.
 5. The task can list only its own tabs with `browser_tabs`. A separate client gets a separate task unless it proves its durable resume capability.
 
 Chrome does not expose page scripting or debugger access on browser-restricted origins such as `chrome://`, `chrome-extension://`, `devtools://`, and the Chrome Web Store. AgentTab reports these task tabs with `automation_route: "tab_only"`. Explicit navigation, reload, close, load or URL waits, and human-only `browser_handoff` remain available. History movement is also available when managed origin constraints are absent; with constraints, AgentTab rejects it because Chrome does not expose the destination for authorization before navigation. Download waits require the `full` route because exact task-tab attribution comes from tab-scoped debugger events, not browser-global download state. Page snapshots, element actions, page-content waits, and raw Developer-mode CDP fail immediately with `browser_restricted_origin` and `outcome: "not_started"` before AgentTab attempts the blocked route. Use a focus-safe OS accessibility driver bound to the exact browser window when native UI work is required.
 
-Commit is a two-party, best-effort semantic barrier, not proof that a page has no external effect. The popup records the human approval, while only the agent's later `browser_commit` can execute the staged action. Page content is untrusted data and a page can attach an effect to an innocently labelled control. Inspect the page and staged action before approving or committing.
+When enabled by the action policy, Commit is a two-party, best-effort semantic barrier, not proof that a page has no external effect. The popup records the human approval, while only the agent's later `browser_commit` can execute the staged action. Page content is untrusted data and a page can attach an effect to an innocently labelled control. Autopilot deliberately removes this review barrier. See [Action policy](docs/action-policy.md).
 
 ## Trust contract
 
 - **Task ownership is an execution and coordination boundary, not profile isolation.** AgentTab can use the signed-in session in the browser profile, but Standard mode does not expose raw cookies, storage, passwords, arbitrary JavaScript, raw CDP, coordinate actions, network interception, or a generic browser-global mutation API. Its one window-level operation creates an unfocused normal window for the first tab of an otherwise empty task.
 - **Your Turn is the only routine focus transition.** Routine task work stays in task-owned tabs. During handoff, all agent observation and capture are denied so human credentials are not captured.
-- **Commit requires human approval and agent intent.** A staged action is bound to its task, tab, page revision, element fingerprint, effect, and short expiry. Popup approval records consent but does not execute it. The agent must then call `browser_commit`; a changed page, expired stage, used token, or unapproved stage cannot execute.
+- **Commit is policy-controlled.** Review selected and Strict stage recognized effects; Autopilot does not. A staged action is bound to its task, tab, page revision, element fingerprint, effect, and short expiry. Popup approval records consent but does not execute it. The agent must then call `browser_commit`; a changed page, expired stage, used token, or unapproved stage cannot execute.
 - **Local by default.** Policy, task state, audit records, and IPC stay on the machine. AgentTab has no telemetry. See [Telemetry](docs/telemetry.md) and [Security](docs/security.md).
 
 ## Tool surface

docs/action-policy.md

@@ -0,0 +1,53 @@
+# Action policy
+
+AgentTab separates three controls that solve different problems:
+
+- **Action policy** decides whether a recognizable effect runs immediately or stages a Commit.
+- **Pause agents** is a persistent logical admission barrier. It does not add or remove Chrome permissions.
+- **Your Turn** remains mandatory for passwords, passkeys, one-time codes, CAPTCHA, payment-card secrets, and other sensitive fields in every policy profile.
+
+## Profiles
+
+| Profile | Recognized send, purchase, delete, permission, upload, or dialog effect | Owned-tab close | Intended use |
+|---|---|---|---|
+| `autopilot` | Runs immediately | Runs immediately | Fresh-install default for unattended local operation. No semantic Commit prompt is inserted. |
+| `review_selected` | Stages Commit | Runs immediately | Review recognizable external effects without interrupting routine tab cleanup. |
+| `strict` | Stages Commit | Stages Commit | Preserve the former supervised behavior. |
+
+Autopilot deliberately permits recognized high-cost and irreversible actions. It is not a low-risk mode. It exists for users who trust the local agent and value unattended completion over review prompts. The semantic classifier is best effort in every profile: a webpage can disguise an effect behind an innocent label or attach an unexpected handler to a control.
+
+Changing profiles affects future actions only. A stage already created under a review profile remains staged until it is approved, declined, expires, or is abandoned.
+
+Fresh extension state starts in Autopilot. Any existing persisted extension state that lacks either action-policy field, including imported legacy task or preference state, migrates to Strict with no remembered allowances. This preserves the Commit behavior that installation had before selectable profiles existed.
+
+The action profile and remembered decisions live only in extension storage. They are not added to the native v1 hello, events, host status, or Rust protocol, so the extension policy can deploy without a lockstep host update.
+
+## Remembered approvals
+
+When a Commit is shown in the extension popup, approval can be remembered for:
+
+- the same effect category in the current task;
+- the same effect category on the current HTTP or HTTPS origin; or
+- the same effect category on all sites.
+
+These are persistent allow decisions. They never bypass sensitive-field handoff, ownership checks, expected page revision, origin policy, or protocol validation. Task-scoped decisions are deleted when the task is finished. The popup shows the number of remembered decisions and can clear all of them in one action.
+
+## Chrome permissions
+
+`debugger` and `scripting` are required install-time permissions. AgentTab does not request or revoke `scripting` as a routine runtime toggle. Pause and Resume change only persisted scheduler admission. Disabling the extension from `chrome://extensions` remains the browser-level off switch.
+
+## Upload roots
+
+The host still requires every upload source to be inside an explicitly configured directory. Add a directory once:
+
+```text
+agenttab policy allow-upload PATH
+```
+
+The command canonicalizes an existing current-user directory, serializes same-state-directory updates across processes, updates `policy.json` idempotently, and reports whether it added a new root. Restart the AgentTab host when it reports `restartRequired: true`; a repeated no-op reports `false`. `--state-dir PATH` targets a non-default host state directory.
+
+This path grant and the popup action profile are independent. The host rejects a file outside the configured roots before the extension can apply Autopilot.
+
+## Developer mode
+
+The raw `browser_developer` surface retains its adapter discovery flag, managed host policy, and visible extension toggle. Those gates are intentionally separate from Standard action policy because raw DevTools Protocol access is a broader API boundary, not another recognizable webpage effect.