Skip to content

Split Settings into separate Settings, Providers, and Permissions pages - #3238

Merged
esokullu merged 10 commits into
webbrain-one:mainfrom
esokullu:main
Oct 19, 2026
Merged

esokullu merged 10 commits into
webbrain-one:mainfrom
esokullu:main

Conversation

@esokullu

Copy link
Copy Markdown
Collaborator

No description provided.

esokullu and others added 10 commits October 19, 2026 19:45
Settings is now three pages that share one controller (settings.js) and
one stylesheet (settings.css, moved out of the inline <style>):

- settings.html: General, Budgets, Memory, Skills, CAPTCHA, Bridge and
  Advanced tabs. Advanced is a tab instead of a drawer inside General,
  and the CAPTCHA solvers have a tab of their own. Budgets holds the
  cloud cost allowances, the clarify timeout and what happens when it
  runs out, Max Agent Steps, the LLM request timeout and the image
  budget. Screenshot redaction moved to Advanced. Language and UI zoom
  are left to the side panel, which has both. The header links to
  Providers, and one search box covers General, Budgets, CAPTCHA and
  Advanced, showing each match under its tab name.
- providers.html: LLM, Vision, Speech, Generative, Decision and
  SafeSocial tabs, opened from More... in the side panel's model picker
  and from the Settings header.
- permissions.html: the permission gate and per-site grants, opened from
  the side panel's permission menu.

Each section of settings.js wires itself only when its markup is on the
page. settings-tabs.js takes its configuration from the tab bar, so old
settings.html#providers, #multimodal, #vision and #permissions links open
the new pages. Background sender checks follow the controls: local vision
consent and choice, D1 controls and fixtures, decision fixtures and
SafeSocial accept providers.html; MemCode and feedback diagnostics stay
on settings.html; the Firefox BiDi check ignores the URL hash.

Auto-screenshot defaults to On navigation in Settings, the agent and the
portable config. Record traces now sets both trace tiers together; a
one-time migration (traceTiersMergedV1) lines up installs whose tiers
differed, and restoring a config export derives full request details
from Record traces.

All 23 locales in both builds drop the language, zoom and lossless-trace
strings, gain the tab and page names, and mark On navigation as the
default. Model-facing guidance and errors name the new locations.

test/settings-pages-ui.mjs drives the three pages in both builds and
runs in the quick shard; test/run.js and the UI suites follow the new
layout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AvDSV8NsDKqeG5VG9ZH1Zj
- User guide (English and Chinese): Settings, Providers, CAPTCHA,
  Apocalypse Mode, subscription proxy, Ollama, MCP, LM Studio, safety
  and the overview describe the new tabs and pages, the Budgets tab, the
  On navigation default and the single Record traces switch.
- Screenshots regenerated from a synthetic profile (no real keys) with
  JEV_DOC_SCREENSHOTS; the Vision tab replaces the Assistive Models shot,
  and Budgets and CAPTCHA are new.
- FAQ sources in all 23 languages name Providers -> Vision, Settings ->
  Advanced -> Screenshot redaction and Settings -> Memory; npm run
  build:web regenerated the landing and FAQ pages (and caught up three
  FAQ pages that had drifted from their sources).
- Repository docs, architecture notes, manual test notes, the privacy
  policy's opt-out path and the CHANGELOG follow the new layout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AvDSV8NsDKqeG5VG9ZH1Zj
- Trace tiers: the one-time merge now runs from onInstalled when the
  extension updates. A new install only records that the merge is done,
  so a harness that sets the tiers apart on a fresh profile keeps them.
- Provisioning: a config patch that turns Record traces off turns full
  request details off too. A patch never turns full details on, since
  exports never carry them.
- Search: rows are hidden with the search's own class, and rows hidden
  for another reason never count as matches, so clearing a search or
  changing the language can no longer reveal the managed CAPTCHA card.
  A managed browser also hides the CAPTCHA tab and opens on General.
- Profile sync: after a sync on Settings, other open settings pages
  (Providers above all) reload what they show over a BroadcastChannel,
  so a later Save there cannot write stale values over the synced ones.
- Docs: the remaining provider, permission and language references point
  to the Providers page, the Permissions page and the side panel, in
  English and Chinese; the search box sits below the tab bar; the
  lossless tier is described as part of Record traces; the CHANGELOG
  notes that a restored older export keeps its auto-screenshot value.
- The anonymous test runner opens the Providers page when no provider is
  set up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AvDSV8NsDKqeG5VG9ZH1Zj
A trace of "download this video from X and send it to a contact on
WhatsApp" (Chrome, Lean mode) clicked the contact's chat row and Attach
over and over, then gave up without sending. Four causes:

- WhatsApp's chat rows are grid cells that ignore a script-dispatched
  click. click_ax's trusted CDP retry was limited to generic, listitem
  and row targets, so the row never opened. Grid cells now get the
  retry too (Chrome).
- In an open chat, the recipient guard blocks every message action
  until the run has confirmed the chat's contact, but the block only
  said to re-read and retry. It now names the control that confirms it:
  the contact name in the chat header, by ref when the page issues one,
  then the Contact info panel's own Close button.
- A click on another chat's row was blocked as a message action as
  well, so a run that started in the wrong chat could not reach the
  right one. A chat-list row (not its menu or a control nested in it)
  now passes as a conversation selection that sends nothing. When the
  request names the person, the run's one contact check follows the
  chat WebBrain opens until the header click arms it; a request for the
  open chat keeps its check there, and a selection change after the
  check is armed still spends it.
- Lean runs had no chat_observe or chat_send, which the guard's repairs
  and the planner's chat steps use. On WhatsApp Web and Telegram Web
  they now get those two tools, also after a mid-run navigation there.

Chrome and Firefox, except the real-mouse retry, which is Chrome's.
Adds test/whatsapp-chat-selection.mjs and a grid-cell fixture test,
extends lean-mode and run.js coverage, and updates the WhatsApp adapter
note, docs and changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012C6yB5Y75Q7H8kDup9DrJ3
Brings in the 68 commits on main since f70156b, among them a344302,
which removes the malicious VS Code task and the payload it ran.

Conflicts:
- settings.html (both builds): main turned D1's Download and Load buttons
  into one #d1-load button. This branch moved the decision models card to
  providers.html, so the change is applied there.
- test/systemone-ui.mjs: keeps this branch's shared stub, with main's
  cloudflare/clef-flash decision model.
- package.json: main's shard lists, plus test:settings-pages:ui in the
  quick shard.
- docs/providers-and-models.md: main's Load wording, on the Providers page.

test/d1-settings-ui.mjs, new on main, now opens providers.html#decision,
and D1 comments that pointed to Settings name the Providers page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AvDSV8NsDKqeG5VG9ZH1Zj
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NcAPScZxdxMKhd1hR3P1LU
Split Settings into Settings, Providers and Permissions pages
WhatsApp: open chat rows and name the control that confirms a contact
@vercel

vercel Bot commented Oct 19, 2026

Copy link
Copy Markdown

@esokullu is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.

@esokullu
esokullu merged commit 0720b04 into webbrain-one:main Oct 19, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants