Add: per-site enforcement denylist authored from the popup (ADR-0018)#235
Merged
Conversation
Adds a one-click "Disable on this site" / "Re-enable on this site" toggle
to the toolbar popup and an audit-and-edit "Sites with enforcement
disabled" section to the Options page. Storage is an array of URL Pattern
strings under `agent-browser-shield.site-denylist`; the popup writes
`${scheme}//${host}/*` for the active tab and "Re-enable" removes every
entry matching the active URL. Effective enforcement is composed from
`global enforcement && !matchesAnyDenylistPattern(topFrameUrl)` —
subframes inherit by asking the background for the tab's top-frame URL.
The same `siteDenylist` key is a new reserved key on the build-time
overrides file (spec 0011) and round-trips through the Options-page
*Export configuration* / *Apply configuration* surface, so a tuned
extension's exported JSON can be fed back into the next build. Bad
patterns fail the build loudly via the existing zod loader.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
knip flagged the speculative `getEffectiveEnforcement` accessor as unused. The rule engine consumes `initEffectiveEnforcement` + `subscribeEffectiveEnforcement` only; the snapshot accessor was defensive surface with no caller. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![unblocked[bot]](https://avatars.githubusercontent.com/in/166219?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
string[]of URL Pattern strings underagent-browser-shield.site-denylist; the popup writes`${scheme}//${host}/*`for the active tab; Re-enable removes every entry matching the active URL.globalEnforcement && !matchesAnyDenylistPattern(topFrameUrl). Subframes inherit by asking the background once for the tab's top-frame URL (newget-tab-urlmessage); pure-top-frame computation usesglobalThis.location.hrefso SPA route changes re-evaluate on the next storage event.siteDenylistreserved key on the build-time overrides file (spec 0011 / ADR-0018), validated via zod +new URLPattern(entry). Round-trips through the Options-page Export configuration / Apply configuration surface.ADR:
decisions/0018-per-site-enforcement-denylist.mdSpec updates:
specs/0010-extension-ui-and-controls.mdFR-7a–FR-7d, FR-10a, FR-10b, FR-15;specs/0011-build-time-customization.mdFR-3 (siteDenylist), FR-4 (loud failure on bad pattern).What's NOT in scope
Test plan
extension/src/lib/__tests__/site-denylist.test.ts— unit coverage forhostPatternFor,matchesDenylist,findMatchingPatterns,addHostPattern,removeMatchingPatterns,isContentSchemeUrl,isValidPattern.extension/src/lib/__tests__/site-denylist.property.test.ts—fast-checkround-trip invariants: pattern fromaddHostPatternalways matches the URL;removeMatchingPatternsleaves no matching pattern.extension/src/options/__tests__/parse-config.test.ts—siteDenylistround-trip + bad-shape rejections through the Options-page Apply configuration surface.extension/scripts/__tests__/load-default-overrides.test.ts— build-timesiteDenylistvalidation (valid list, empty list, non-array, non-string entry, invalid URL Pattern).extension/src/lib/__tests__/rule-engine.test.ts— mock swapped fromenforcement.tstoeffective-enforcement.ts; all 12 existing reconciliation cases pass.bun run check(biome + eslint): clean.pre-commit run --all-files: clean (afterbun installindemo-site/).bun run build --defaults <file>with a validsiteDenylistinjects the pattern intodist/content.js; with an invalid pattern, build fails loudly with a path-qualified zod message.🤖 Generated with Claude Code