[kerdofficial]

What changed

Browser fill and capture now connect only to browsers the owner trusts. Owner vault settings gain cdp_endpoints: trusted browser origins such as http://127.0.0.1:9222. A local request may use an endpoint that matches one of them, or an HTTPS/WSS endpoint that meets the existing remote_cdp_hosts rules. Anything else is refused with missing_permission before Inbot connects, and that includes loopback endpoints that are not registered. Tunnel requests keep the remote rules and ignore cdp_endpoints. PUT /v0/owner/vault/settings now updates only the keys you send.

Credential use requests now include browser: { endpoint, selector, target_id? }. The endpoint is the origin of the agent's CDP endpoint, with no path, query or credentials, so the owner approves a concrete sink. The approval fingerprint still binds the full endpoint, so swapping it after approval still returns idempotency_conflict.

Capture is now gated by use_policy like fill. It uses kind capture, needs an idempotency key on approval grants (REST, MCP capture_credential and CLI) and runs under the same lock as fill. Origin and CDP protocol errors no longer echo text supplied by the peer.

Migration 20 adds cdp_endpoints and rebuilds credential_use_requests so that it allows capture and stores browser. Existing rows are kept.

Why

Before this change, a local request could name any CDP endpoint. The origin check trusted that endpoint's own frame tree and the secret went out through Input.insertText, so the agent chose where the password went. The approval also never showed the endpoint. Capture skipped approval and ran outside the lock.

This is a partial mitigation, not browser authentication: Inbot still cannot authenticate a CDP peer. If a registered local browser stops, a process that binds its port can stand in for it. The docs now say so plainly. An Inbot-owned browser over a CDP pipe would close that gap and is left for a follow-up.

Upgrading changes behavior: until the owner registers a browser under Settings > Trusted browsers or with inbot vault settings set --cdp-endpoints ..., local fill and capture fail with an error that explains how to register one.

UI changes

Approvals now show the browser and field selector:

Settings has a Trusted browsers list above Remote browser hosts:

Checklist

• The PR title follows conventional commits
• The PR does one thing
• pnpm check passes locally
• Every affected surface is covered (contract, service, REST, MCP, CLI, web, events, permissions, remote access, docs)

Proof: I ran format, lint, typecheck and vitest (1034 passed). A regression test fails when the old local bypass is restored. On an isolated home, an unregistered loopback listener received no connection for fill or capture, and approval requests showed the sink without the query token. Only synthetic credentials were used.