diff options
| author | Tianren Dong <tianrendong.dtr@gmail.com> | 2026-05-14 22:09:07 -0400 |
|---|---|---|
| committer | Tianren Dong <tianrendong.dtr@gmail.com> | 2026-05-14 22:09:07 -0400 |
| commit | a13b6e4b51daf687e0cb16ef8fbc7040fde415a9 (patch) | |
| tree | 56309e6cf89c98b428fa173bd785ef97bab5b9be /SECURITY.md | |
| parent | 815fd19c72f7a5a57f87eb0debe50194588e0202 (diff) | |
Restore terminal Chrome authorization
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/SECURITY.md b/SECURITY.md index afa4e15..ffc2c06 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,13 +9,14 @@ Open a GitHub issue prefixed with `[security]` at https://github.com/tianrendong `pi-chrome` is a developer tool you install knowingly. It is **not** designed to defend against: - Hostile pages running in your Chrome trying to detect or escape automation. (Standard browser security boundaries still apply, but a hostile page that already runs in your tab can do anything that page can already do.) -- Other processes on your local machine. The bridge binds to `127.0.0.1:17318` (loopback only) but **does not authenticate** local callers. Any process running as your user can issue commands. If your threat model includes hostile local processes, run pi-chrome on a separate user account. +- Other processes on your local machine. The bridge binds to `127.0.0.1:17318` (loopback only) and chrome_* tools require `/chrome authorize` inside Pi, but the bridge does not authenticate arbitrary non-browser local callers. If your threat model includes hostile local processes running as you, run pi-chrome on a separate user account. `pi-chrome` **is** designed to: - Never exfiltrate page state to the network. All communication is loopback (`127.0.0.1`). - Surface every action with an honest result envelope so the agent can't silently do the wrong thing. -- Require explicit opt-in for trusted-input mode (`/chrome clicks on` or `trusted: true`), which uses `chrome.debugger` and shows Chrome's banner. +- Keep Chrome control locked until the user explicitly runs `/chrome authorize` in the current Pi session. +- Reject browser-origin command requests to the loopback bridge so ordinary web pages cannot use CORS to drive Chrome. ## The companion extension @@ -24,14 +25,13 @@ The Chrome extension under `extensions/chrome-profile-bridge/browser-extension/` ## Defaults - Loopback bridge only. No remote port. No telemetry. -- Synthetic events first; trusted CDP only when explicitly enabled. -- Quiet mode optional; tab/window focus is observable (the user can see Pi acting). +- Chrome real input layer for interactive controls. +- Chrome control locked by default; `/chrome authorize` unlocks current Pi session after terminal confirmation, `/chrome revoke` locks it again. +- Run-in-background optional; tab/window focus is observable by default (the user can see Pi acting). -## Override the port +## Custom ports -```bash -PI_CHROME_BRIDGE_PORT=17319 pi -``` +The bundled Chrome extension currently polls `127.0.0.1:17318`. Custom bridge ports are not supported without editing the extension source and reloading it. ## Supported versions |