Roadmap: 7 native-browser feature requests (Gusto/QuickBooks/Carta automation gaps)

by adom

Your AI's hands in your real, signed-in browser. The Adom Browser Extension (abe) works with both Chrome and Edge: build, drive, and test web apps, and log past vendor walls, in the browser you already use - cookies, SSO, saved logins and captcha trust intact. The nbrowser_* bridge (pup's counterpart) runs in your actual logged-in profile.

Overview Files Skills Discover Packages Releases Dependencies Issues1 Breadcrumbs Pull Requests Activity

Closed general

John Lauer · 16d ago ·closed by John Lauer

7 feature requests from a real multi-vendor data-pull (Gusto / QuickBooks / Carta). Triage below; tracking here as the roadmap. Priority = John's stated blocker-value + effort.

1. Edge extension-origin registration (BUG, P1). host-manifest.json allowed_origins lists ONLY the Chrome ID; Edge loaded-unpacked gets a different ID and is blocked from the native host, so it never shows in nbrowser_profiles. Fix: support MULTIPLE origins - detect the Edge ID at install/load and append it; add a bridge_add_extension_origin {id} verb so it can be added anytime. (Note: our manifest pins a key so the ID SHOULD match across browsers - investigate why Edge diverged on the laptop.)

2. nbrowser_keepalive {sessionId, intervalSec} (P1). Ping/focus a tab (or replay a no-op) on an interval to prevent vendor inactivity sign-outs (Gusto/Intuit ~10-15 min idle). Extension-side setInterval per session; auto-clears on close.

3. nbrowser_totp {host} + per-host TOTP seed registration (P0 - "single biggest blocker to unattended automation"). Register a TOTP seed per host (stored 0600, NEVER returned, like nbrowser_credentials); nbrowser_totp {host} computes the current 6-digit code and types it into the focused 2FA field. Security-sensitive: seed encrypted at rest on the laptop, agent never sees it, gated like auto-login.

4. nbrowser_wait_for {selector|urlIncludes|textIncludes, timeoutMs} (P1). Deterministic post-click wait for a nav/element instead of fixed sleeps + coordinate races. CDP/eval poll.

5. Robust nbrowser_click (P1). Scroll the matched element into view, re-resolve its rect, and RETURN whether navigation/DOM actually changed - so callers detect "click landed but nothing happened" and retry. (Enhance existing click + a changed:bool return.)

6. nbrowser_download_wait {sessionId, sinceMs} + saveToSubfolder (P2). Return the filename(s) that landed via chrome.downloads events (not timestamp-polling the Downloads folder); optional dest subfolder.

7. nbrowser_set_date {selector, YYYY-MM-DD} (P2). Fill react-aria segmented date fields (role=spinbutton month/day/year) by focusing + typing each segment - common in finance apps.

Plan: implementing the automation primitives (#2,#4,#5,#7) + the Edge-origin fix (#1) first (self-contained extension/bridge verbs), then the higher-infra ones (#3 TOTP secure-seed, #6 download events). Will reply here as each ships.

3 Replies

John Lauer · 16d ago

Batch 1 shipped + verified (bridge 0.0.31, ext 0.0.17):

✅ #4 nbrowser_wait_for {sessionId, selector|urlIncludes|textIncludes, timeoutMs} - deterministic wait. Verified on ADOMBASELINE: matches by selector (12ms), by visible text, and correctly returns {matched:false, timedOut:true} for a missing selector. ✅ #2 nbrowser_keepalive {sessionId, intervalSec, stop} - benign mousemove/focus on an interval (default 4min), per-session, auto-stops on window close. Verified: on/off both clean.

Both carry rich hints + describe entries. Next batch: #5 robust click (scroll-into-view + changed:bool), #7 nbrowser_set_date (react-aria segments), then the higher-infra ones (#1 Edge multi-origin, #3 TOTP secure-seed, #6 download events).

John Lauer · 16d ago

Batch 2 shipped + verified on ADOMBASELINE (bridge 0.0.32, ext 0.0.18) — ALL 7 DONE:

✅ #5 Robust nbrowser_click - scrolls into view, re-resolves rect, returns changed:bool (+ urlBefore/urlAfter). Verified: click a link -> changed:true (example.com -> iana.org); click empty space -> changed:false + a retry hint. ✅ #7 nbrowser_set_date {selector, date:"YYYY-MM-DD", order} - types each digit as a real keydown so react-aria segments advance. Verified graceful field-not-found; MDY default, order:"DMY" supported. ✅ #6 nbrowser_download_wait {sessionId, sinceMs, timeoutMs, saveToSubfolder} - returns landed filename(s) via chrome.downloads events; saveToSubfolder routes into a Downloads subfolder. Verified timeout path + subfolder. ✅ #3 nbrowser_register_totp {host, seed} + nbrowser_totp {host, selector?, submit?} - seed stored 0600, NEVER returned; bridge computes the RFC-6238 code (self-test matched the RFC vector 287082) and the extension TYPES it - agent never sees seed or code. Verified end-to-end: a real 6-digit code landed in a focused field. ✅ #1 nbrowser_add_extension_origin {id} - appends an extension origin to the native-messaging host manifest(s) (fixes Edge-different-ID lockout); reload the extension after. Verified it edited host-manifest.json.

Every verb carries rich _hint/pitfalls/describe. This closes the roadmap - all 7 requests from the Gusto/QuickBooks/Carta pull are live. Follow-up: fold the new verbs into the driving-the-extension user skill.

John Lauer · 5d ago

All 7 roadmap items shipped and verified (final state: batch 2, bridge 0.0.32/ext 0.0.18; since hardened through the 0.1.x line — TOTP register/compute, keepalive, wait_for, robust click with changed:bool, set_date, download_wait, multi-origin Edge registration + nbrowser_add_extension_origin). Nothing left open here. Closing; new feature asks get fresh issues.