Actionbook

Actionbook is a local bridge that connects the Actionbook command-line interface (CLI) to your browser, enabling user-initiated browser automation for AI agents and developer tools — entirely on your machine.

HOW IT WORKS
• This extension requires the Actionbook CLI installed locally.
• The extension establishes a WebSocket connection to a bridge service running on localhost (127.0.0.1).
• When you run browser commands through the Actionbook CLI, the local bridge relays those commands to the extension.
• The extension attaches the Chrome DevTools Protocol (CDP) to a tab you explicitly select and executes only a strict allowlist of permitted CDP methods.

All communication stays on your local machine. The extension does not communicate with Actionbook-operated external servers.

KEY FEATURES
• Tab Management — List tabs, create tabs, activate tabs, and attach automation to a specific tab.
• Page Navigation — Navigate to URLs and reload pages programmatically.
• DOM Inspection — Query document structure and read page content.
• Screenshot & PDF Capture — Capture screenshots and print pages to PDF for inspection or archival.
• Input Simulation — Dispatch mouse clicks and keyboard events for automated interactions.
• JavaScript Evaluation — Evaluate JavaScript in the page context via CDP for user-requested automation steps.
• Cookie Management — Read, set, and remove cookies scoped to a specific URL/domain provided by the workflow.
• Auto-Connect — When the local bridge is running, the extension can connect automatically without manual configuration.

SECURITY MODEL
Actionbook is designed to keep automation visible, scoped, and user-controlled:

• Explicit Tab Attachment
Automation runs only on the tab you attach/open as part of the automation session.

• Chrome Debugger Visibility
CDP requires the Chrome “debugger” attachment. While attached, Chrome displays its standard debugging infobar/banner.
Dismissing the banner or closing the tab ends the session.

• CDP Command Allowlist
Only a curated allowlist of CDP methods is permitted. Any method not on the allowlist is rejected.

• Risk-Based Approval Gate
Commands are categorized into three risk levels:
- Level 1 (Read-only): e.g., screenshots, DOM queries, reading cookies (auto-approved)
- Level 2 (Page modification): e.g., navigation, input events, JavaScript evaluation (auto-approved)
- Level 3 (High-risk): e.g., writing/deleting cookies, clearing site data, changing download behavior (requires explicit confirmation)

• Sensitive Domain Protection
On sensitive domains (banking, payment/checkout, government, healthcare), Level 2 commands are automatically elevated to Level 3
and require explicit confirmation in the extension popup. Confirmation requests expire automatically if not acted upon.

PRIVACY
To perform the automation steps you explicitly trigger, the extension may access and process locally:
• Web history signals: tab URL and title (so the CLI can target the correct page)
• Website content: DOM/text and page captures (screenshots/PDF)
• Authentication-related data: cookies for a specific URL/domain provided by the workflow

Actionbook does NOT send this data to Actionbook-operated external servers.
The extension communicates only with the localhost bridge (127.0.0.1) running on your machine.
No analytics, telemetry, tracking, or advertising are included.

GETTING STARTED
1. Install the Actionbook CLI (see https://actionbook.dev).
2. Install this extension from the Chrome Web Store.
3. Setup the CLI Extension Mode and run browser commands through the CLI:
actionbook browser open "https://example.com"
actionbook browser screenshot result.png
actionbook browser click "button.submit"

The CLI bridge starts automatically when you run browser commands — no manual setup needed.

LOCAL STORAGE
The extension may store minimal local settings in chrome.storage.local (for example, connection/pairing compatibility settings).
It does not store browsing history, page content, or cookies.

REQUIREMENTS
• Actionbook CLI installed on your machine
• Chrome browser (or Chromium-based browser)

OPEN SOURCE
The full source code is available for inspection at https://github.com/actionbook/actionbook. Security researchers and developers are welcome to audit the code.

SUPPORT
For bug reports, feature requests, or questions, visit: https://github.com/actionbook/actionbook/issues