archive/yaklang-chrome-extension
1
0
Fork 0
mirror of https://github.com/yaklang/yaklang-chrome-extension.git synced 2026-09-27 05:31:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Enhance architecture documentation and update project dependencies. Introduce new features for browser recording, page callables, and transform capabilities. Improve build scripts and permissions for better functionality.

Browse Source
This commit is contained in:
go0p
2026-08-06 15:11:35 +08:00
committed by go0p
parent 0371a8b802
commit af5a4db694
125 changed files with 25018 additions and 1675 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/store-review/CHROME_WEB_STORE.md
+11 -3
View File
@@ -2,7 +2,13 @@
## Single purpose
Yakit Browser Agent provides consent-gated browser context and request workflows for authorized security testing with a local Yak/Yakit engine. Cookie, proxy, UA, observation and request tools support that single authenticated-browser testing workflow; they do not provide unrelated browsing, advertising or content features.
Yakit Browser Agent provides consent-gated browser context, frontend-crypto analysis and request workflows for authorized security testing with a local Yak/Yakit engine. Cookie, proxy, UA, browser-recording, Chromium Deep Capture and request tools support that single authenticated-browser testing workflow; they do not provide unrelated browsing, advertising or content features.
## Debugger permission
Chromium packages request `debugger` for an explicit Deep Capture workflow. The extension attaches only after the user or a separately scoped local-engine grant arms one named crypto operation or request substring. It installs a one-shot function/XHR breakpoint, publishes bounded call-frame/scope previews, and lets the user retain one in-scope function as a current-document page callable. The page automatically resumes after 45 seconds without keepalive. Grant expiry/revocation, tab closure and explicit detach release the session. Firefox packages do not request or advertise this capability.
No browsing session is debugged continuously, no traffic is intercepted through CDP in this phase, and key objects/function closures remain inside the target document.
## Remote code policy
@@ -18,7 +24,7 @@ Chrome's MV3 policy names User Scripts as an API permitted to execute remote log
## User data and Limited Use
The listing and privacy form must disclose authentication information, browsing activity, website content, Cookie/storage data, request data and local Native Messaging transmission. Data is handled only for the user-facing security workflow, sent only to the user's explicit local endpoint, never sold, never used for advertising, and not sent to developer analytics. Local processing still requires disclosure under the [User Data FAQ](https://developer.chrome.com/docs/webstore/program-policies/user-data-faq).
The listing and privacy form must disclose authentication information, browsing activity, website content, Cookie/storage data, request data and local Native Messaging transmission. A user-saved Transform Gateway may keep a bounded, independently clearable plaintext replay draft in extension-local storage; that draft is not included in Bridge/Yak/AI traffic, diagnostics, audit or profile export. Data is handled only for the user-facing security workflow, sent only to the user's explicit local endpoint, never sold, never used for advertising, and not sent to developer analytics. Local processing still requires disclosure under the [User Data FAQ](https://developer.chrome.com/docs/webstore/program-policies/user-data-faq).
## Reviewer test
@@ -29,7 +35,9 @@ The listing and privacy form must disclose authentication information, browsing
5. Create a control grant. Expression Eval succeeds; program Eval remains denied until separately enabled.
6. Start metadata-only request capture. Headers/body appear only after their explicit switches are enabled.
7. Trigger and complete a handoff; verify the action timeline and audit contain metadata only.
8. Inspect the Store artifact: no `page-main-world.js`, no `activeTab`, and `nativeMessaging` is optional.
8. Record one real WebCrypto operation, choose Deep Capture, arm the selected operation and repeat it. Verify the page visibly pauses, a business frame/scope appears, and **仅恢复页面** immediately releases it.
9. Capture an in-scope function, run it with a new JSON argument, then reload the page and verify its document-bound callable is gone.
10. Inspect the Store artifact: no `page-main-world.js`, no `activeTab`, `debugger` is present only in Chromium, and `nativeMessaging` is optional.
Automated equivalent: `pnpm verify:ui:store`.