# Persimmons Chromium extension v0

A small load-unpacked experiment for the Persimmons authority model:

`🍊 source authority -> Squeeze -> 💧 scoped authority -> agent`

The extension is a capture + delegation surface, not a general password manager.

## Load unpacked

1. Open `chrome://extensions`.
2. Enable **Developer mode**.
3. Choose **Load unpacked**.
4. Select this repository's `extension/` directory.
5. Pin **Persimmons**.

There is no build step.

## Taste test

### Current-site session

1. Sign in normally to a test site such as `wp.phly.cloud` or `teahub.xyz`.
2. Open the Persimmons extension.
3. It shows the current site. The first capture on a site asks Chromium for access to that origin.
4. Choose **Save this session**.
5. Persimmons filters obvious analytics/consent cookies, caps the capture at 64 cookies / 16 KiB, and sends the session bundle once to the existing caller-scoped Persimmons create endpoint.
6. The backend stores the source value in Gitea Actions secrets. The extension receives only the public connection record.
7. Leave **read site** / **edit drafts/pages** enabled and choose **Squeeze for agent**.
8. A 💧 capability is created with one-hour expiry.
9. Choose **Revoke juice**. This revokes the capability metadata without deleting the source 🍊.

### API token / PAT

Choose **Use API token**, paste the token, and save. The input is cleared after a successful write. The stored value is not returned by the Persimmons API.

## What is stored

- **🍊 source credential/session:** existing Persimmons Gitea Actions secret substrate, write-only after save.
- **🍊 metadata:** existing Persimmons Gitea Actions variable metadata.
- **💧 Juice:** separate capability metadata only (source id, origin, subject, scopes, expiry, status). Juice does not contain the source secret.
- **Extension local storage:** only the Persimmons public source id/name for the current origin. No raw cookie/token is intentionally persisted in extension storage.

The extension never prints captured cookie values or token values to the console.

## Passkeys / WebAuthn

v0 does not export passkey private keys. Non-exportable key material stays in the authenticator. Persimmons should model the site/account/authenticator relationship and mediate future authorization rather than treating a passkey as a password blob.

## Threat-model limitations

- A captured browser session can be high authority. v0 relies on the user's explicit origin permission and explicit **Save this session** action.
- Cookie heuristics are deliberately small and may capture more authority than a service-native scoped token. Prefer a provider-native PAT/OAuth grant where available.
- 💧 in v0 is real, revocable policy metadata. It does **not yet** execute downstream requests on behalf of an agent. The next executor/mediator must consume Juice + the stored source credential internally and return task results, never the source credential.
- Revoking Juice does not invalidate a live browser session at the source service.
- Compromise of the signed-in browser profile or Gitea account remains outside this extension's protection boundary.
- The broker currently lives at `teahub.xyz`, but Persimmons remains a standalone product surface and the extension has no Phly/Phast/Tea product dependency beyond that storage endpoint.