cli/package.json is now the one release version: the store zip and the
extension bundled in the npm helper are stamped with it. Bumped to 0.0.2
(0.0.1 is on npm and in the store draft).
.github/workflows/publish-browser-extension.yml runs on a
browser-extension-v<version> tag (checked against cli/package.json) or by
hand: typecheck, build the helper and the store zip, smoke test the helper,
upload the zip as an artifact, then publish opencode-browser-cli to npm with
provenance (trusted publishing, or OPENCODE_BROWSER_NPM_TOKEN; skipped when the
version exists) and attach the zip to a GitHub release. Manual runs only
build unless `publish` is checked.
Verified: actionlint (only the repo's custom runner label is unknown to it);
locally, cli build + `bun run package` produced version 0.0.2 in both the zip
(no key) and the bundled extension, the built helper ran, and `npm pack
--dry-run` packs 0.0.2.
- `bun run package` builds and writes release/opencode-browser-<version>.zip
without the manifest `key` (the store rejects it and assigns its own ID) and
without source maps. release/ is ignored.
- history, bookmarks, topSites, and sessions are now optional permissions,
requested from the panel's Allow click on an agent's browsing-data request,
so install shows fewer warnings and review sees them as user-initiated. A
session grant only counts while the browser permissions are held; revoking
them in browser settings makes the panel ask again.
- store/listing.md (listing copy, single purpose, permission justifications,
data disclosures) and store/privacy-policy.md (to host for the listing).
Verified: typecheck, lint, and `bun run package` produced a zip whose manifest
has no key and lists the four optional permissions. The Chrome permission
prompt on Allow was not exercised (headless can't answer it).
Ryan Vogel