feat(desktop): Chrome extensions and passkeys in the browser pane

SE
6h ago
+10188-154

What & why

The browser pane could not run Chrome extensions, so password managers and their passkeys did not work in it. This adds a Chrome extension host: install from the Chrome Web Store, pin to the toolbar, and sign in with LastPass or 1Password, passkeys included.

  • The pane gets its own session, persist:browser. Cookies move over once, and the old site data leaves the app session.
  • Installs, updates that widen access, and Remove ask first, with Chrome's warnings. Extensions follow Chrome's permission rules and cannot act as one another.
  • Agents drive only panes they open, in persist:browser-agent, with none of the user's extensions, and only the cookies the user imports. The browser and panes skills say so.
  • Electron 44.10.0. The packaged app ignores remote debugging flags.

Two packages are patched (patches/electron-chrome-*.patch). The Security table in plans/20261030-browser-pane-passkeys.md maps each fix to its guard test. The maintainer has the findings by email.

Also in here: dark: utilities follow the app theme, an agent-jobs sweep race fix, and hermetic host-service tests.

How I tested it

Full suite (desktop 9130, host-service 2710), lint, typecheck, check:i18n, check:plugins, and a password manager with a passkey login by hand in the dev app.

1Password and LastPass pinned in the browser pane toolbar Unpin in the pinned extension's right-click menu Web Store page in the pane: Google's Install Chrome banner keeps its name, the add/remove button names the app (dev build name shown)

Checklist

  • PR title follows conventional commits (type(scope): subject)
  • bun run lint and bun run typecheck pass (CI fails on lint warnings too)
  • "Allow edits from maintainers" is checked on fork PRs
  • I have signed the CLA (the bot asks on your first PR)