Repository navigation
feat(assistant): ask before the browser opens or types what the assistant wrote after reading a page - #333
Merged
Conversation
…tant wrote after reading a page Once an answer has read text from outside Lens (Toolbox.wary(), #309), an address to open or download and text to type that the person didn't write themselves go to the side panel with confirm (why), and the panel asks for a yes first, on allowed sites too. Links and clicks by ref don't ask. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhTrpdr3XSgcD91oFxAiMQ
17 of 19 tasks
adeelahmad
added a commit
that referenced
this pull request
Oct 10, 2026
…PRs (#335) The README and Get started say the web installer can install with the defaults in one click (#331). "In progress" adds flagging instruction-like third-party text (#329), asking before the browser acts on what the assistant wrote (#333) and cloud model presets (#334). Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
17 of 19 tasks
adeelahmad
added a commit
that referenced
this pull request
Oct 11, 2026
…349) "Stay private and safe" now covers flagging instruction-like text (patterns or the optional local classifier, #329, #347), asking before the browser acts on what the assistant wrote (#333), breaking up links in chat-room answers (#338), the archive as data over MCP (#343) and the audit log of what was caught (#344). "See what it costs" adds the overall budget asked for in setup (#281). "In progress" drops what merged and adds #337, #341 and #346. Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: once the assistant was using your browser (#330), a poisoned page or email could tell it to open
https://some-allowed-site/?d=<what it read>, or to type your notes into a field, and on a site you had already allowed that happened without asking.After: once an answer has read a page, an email or any other text from outside Lens, the side panel asks before opening or downloading an address, or typing text, that you didn't write yourself. That holds on sites you allowed too. The card shows the address or the text and why: "Open evil.example? https://evil.example/?d=42. Asked because this answer read text from outside Lens: tool browser_read." Clicking links, importing them by ref, and typing words from your own message don't ask. Ask before sending data out after reading third-party text (
ai.untrusted_asks, from #309) turns it off.How:
Toolbox._browseaddsconfirm(the reason) toopen,typeandimport-by-address actions whenToolbox.wary()and the text or address isn't in the person's own message (never when it came from a chat room open to anyone). The extension'sHandsasks the person first wheneverconfirmis set (vouch). The browser NOTE tells the model to prefer refs, so routine browsing stays one click.Motivation and Context
This follows up #309 (prompt injection: ask before sending data out) and #330 (browser control), as the prompt-injection thread asked: navigation to addresses the model built counts as sending out once the answer is wary.
Types of changes
!in the title)Checklist:
tests/api/test_browser.pycovers which actions carryconfirmand turning it off; 64 tests in the chat, bridge, extension, assistant, browser and injection suites pass. The Edge smoke test checks that No keeps an address from opening and Yes types; it passes locally in Chromium.docs/accordingly (docs/browser-assistant.md,docs/assistant.md);mkdocs build --strictis clean.## UnreleasedinCHANGELOG.md.Done questions (AGENTS.md)
confirmis part of the action'sargson the documented API, so another side panel can honour it.ai.untrusted_askssetting in Settings → AI assistant.confirmdoesn't ask).DEVLOG.md): Lens checking that the extension asked.🤖 Generated with Claude Code
https://claude.ai/code/session_01PhTrpdr3XSgcD91oFxAiMQ
Generated by Claude Code