Reconcile 0.2.2 and fix Windows broker launch/logging (#5)

PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy Policy — Hermes Connector (unofficial · by Corsen AI)
 
-_Last updated: 2026-08-02_
+_Last updated: 2026-08-03_
 
 Hermes Connector lets a Hermes agent running on your computer read and control
 Chrome tabs that you explicitly attach. Corsen AI does not operate a relay,
@@ -13,7 +13,7 @@ To provide its single browser-control purpose, the extension can handle:
 - website content from attached tabs, including visible text, accessibility
   structure, element labels, and screenshots you request;
 - browsing activity for attached tabs, including their URL and title; when you
-  open **Choose tabs**, current tab titles and URLs are displayed locally so you
+  open **Tabs**, current tab titles and URLs are displayed locally so you
   can choose which tabs to attach;
 - text and navigation instructions sent by your locally configured Hermes agent;
 - Hermes profile and session identifiers and titles read from your local Hermes

PUBLISHING.md

@@ -28,8 +28,7 @@ separately under the same release version.
 
 - Privacy: `https://corsenai.github.io/hermes-connector/privacy/`
 - Support and installation: `https://corsenai.github.io/hermes-connector/support/`
-- Complete video demo: `https://www.youtube.com/watch?v=4akSq9cMmFw`
-- Companion 0.2.1: `https://github.com/CorsenAI/hermes-connector/releases/download/v0.2.1/hermes-connector-0.2.1-companion.zip`
+- Companion 0.2.2: `https://github.com/CorsenAI/hermes-connector/releases/download/v0.2.2/hermes-connector-0.2.2-companion.zip`
 - Source: `https://github.com/CorsenAI/hermes-connector`
 - Support email: `hello@corsen.ai`
 
@@ -59,7 +58,8 @@ Prepared assets:
 - `store/store-icon-128.png` — 128×128;
 - `store/promo-small-440x280.png` — 440×280;
 - `store/screenshot-product-1280x800.png` — 1280×800 real headed-Chrome
-  capture with isolated test data.
+  capture with an isolated real Hermes model, exact attached `example.com` tab,
+  and verified `bridge_status` → `bridge_current_url` → `bridge_read` calls.
 
 Generation/capture provenance and the reproducible screenshot command are in
 `store/ASSETS.md`.
@@ -77,7 +77,7 @@ Declare the data the extension handles even though processing is local:
 - **Website content**: visible text, accessibility structure, element labels,
   and requested screenshots from attached tabs.
 - **Web history**: URLs and titles of attached tabs; current tab titles/URLs are
-  shown locally only after the user opens Choose tabs.
+  shown locally only after the user opens Tabs.
 - **Authentication information**: the persistent local Connector pairing
   credential stored in Chrome local storage, plus the ephemeral Hermes dashboard
   session token read into memory. Only HMAC proofs—not the pairing credential—go
@@ -140,7 +140,7 @@ so use deferred publishing and answer reviewer questions promptly.
       copy is limited to verified platforms.
 - [ ] Pre-submit end-to-end pass in the intended signed-in Google Chrome
       profile using the exact extracted release ZIP.
-- [ ] Privacy URL, support URL, video URL, companion URL, listing, and dashboard
+- [ ] Privacy URL, support URL, companion URL, listing, and dashboard
       declarations are mutually consistent.
 - [x] 128×128 icon, 440×280 promo, and one real 1280×800 screenshot are ready
       and contain no personal data.
@@ -150,7 +150,7 @@ so use deferred publishing and answer reviewer questions promptly.
 
 ## 8. Post-publication verification
 
-- [ ] Confirm the public Store endpoint serves version 0.2.1 for the existing
+- [ ] Confirm the public Store endpoint serves version 0.2.2 for the existing
       extension ID.
 - [ ] Smoke-test the Store-installed build in the intended signed-in Chrome
       profile and confirm an upgraded 0.2.0 profile receives the companion

docs/ACCEPTANCE.md

@@ -53,7 +53,7 @@ the final packaged bits.
 - [x] End-to-end runs are completed in one and two isolated Chrome profiles.
 - [ ] A pre-submit end-to-end run loads the exact packaged ZIP in the intended
       signed-in Google Chrome profile.
-- [ ] After publication, the existing Store ID serves 0.2.1 and its installed
+- [ ] After publication, the existing Store ID serves 0.2.2 and its installed
       build passes a signed-in-profile smoke test.
 
 Evidence for checked gates is recorded in `TEST-EVIDENCE.md`.

docs/ARCHITECTURE-V2.md

@@ -89,7 +89,7 @@ last-used, or first controllable tab.
 - A full Chrome restart preserves browser identity and session preference. Any
   tab that cannot be proven to be the same restored tab must be attached again.
 - Broker or Hermes restarts do not rotate the pairing code.
-- When Chrome updates an older build to 0.2.1, it migrates only the legacy
+- When Chrome updates an older build to a protocol-4 release (0.2.1+), it migrates only the legacy
   default 8765 address to 8766 and keeps a local notice visible until the user
   confirms the separately downloaded companion was reinstalled. The new port
   prevents a detached 0.2.0 broker from silently serving the hardened build.

docs/TEST-EVIDENCE.md

@@ -1,6 +1,37 @@
-# Test evidence — 2026-08-02 — 0.2.1 hotfix
-
-## Why 0.2.1 was required
+# Test evidence — 2026-08-03 — 0.2.2 release candidate
+
+## Why 0.2.2 was required
+
+The public Store endpoint still served 0.2.0 while the 0.2.1 submission was
+being evaluated. A deeper audit found that 0.2.1 was not ready to be treated as
+the final corrective release:
+
+- the side panel called the browser "paired" when only Chrome and the local
+  broker were authenticated; it did not prove that the selected Hermes profile
+  had loaded the Connector tools;
+- successful Connector responses included `"error": null`, which Hermes' generic
+  tool-result detector could misclassify as a failed browser call;
+- switching Chrome tabs did not change the deliberately fixed Hermes target,
+  but the panel did not explain that distinction and could leave users looking
+  at a different page from the one Hermes controlled;
+- internal, blank, loading, local-file, and Chrome Web Store pages did not all
+  produce an early, plain-language refusal;
+- the tab/session controls consumed too much side-panel height and reduced the
+  actual Hermes chat;
+- the first promotional video combined real extension chrome with a fixture
+  page and a prewritten Hermes result. It was rejected and removed from public
+  presentation rather than represented as live evidence.
+
+0.2.2 makes readiness depend on pairing, the selected profile appearing in the
+broker's authenticated `agentProfiles`, and a real active tab binding; removes
+false `error` keys from successful tool
+results, reports and refreshes the real active Chrome tab without silently
+changing authorization, blocks restricted/pending pages before execution, and
+moves secondary controls into compact accessible overlays. The installer now
+verifies every installed companion file byte-for-byte and rolls back on any
+post-publication verification failure.
+
+## Why 0.2.1 was required (historical)
 
 The public 0.2.0 package was installable, but final use exposed production
 paths that the isolated release tests had not covered:
@@ -90,10 +121,10 @@ exact broker process owning its random test port, kept the same `BridgeClient`
 alive, and observed a distinct replacement broker plus a restored authenticated
 connection. All temporary processes and data were removed afterward.
 
-The 0.2.1 broker uses protocol 4 on the new default port 8766. Extension tests
+The 0.2.2 broker uses protocol 4 on the default port 8766. Extension tests
 verify a one-shot migration of all legacy default 8765 URL forms before the
 first connection, while preserving a genuinely custom port. This prevents the
-detached 0.2.0 broker from silently serving 0.2.1 after a normal Hermes restart;
+detached 0.2.0 broker from silently serving a protocol-4 release after a normal Hermes restart;
 an incompatible protocol is rejected rather than used as a fallback.
 Broker persistence tests also verify that protocol 4 imports a validated
 legacy owner only once, ignores a late write from a still-running protocol-3
@@ -102,9 +133,9 @@ complete temporary files for concurrent atomic saves.
 
 ## Multi-profile installation
 
-The 0.2.1 source installer was run locally without printing the pairing secret.
+The 0.2.2 source installer is tested without printing the pairing secret.
 The shared home and every discovered named profile report
-`hermes-connector` 0.2.1 enabled. The known conflicting legacy
+`hermes-connector` 0.2.2 enabled. The known conflicting legacy
 `agent-bridge` payload is preserved but disabled only where its exact legacy
 signature is detected.
 
@@ -115,19 +146,36 @@ named `hermes` cannot break Python discovery. The same Windows gate executes
 the normal-user `Install Hermes Connector.cmd` double-click path. Users must re-run the companion
 installer after creating a new named profile.
 
-## Store artwork
-
-`store/screenshot-product-1280x800.png` was recaptured from the real 0.2.1
-extension panel at exactly 1280×800 with isolated fixture data. The icon,
-440×280 tile, 1400×560 marquee, and screenshot pass the metadata and leakage
-gates.
+## Store artwork and verified live capture
+
+`store/screenshot-product-1280x800.png` is an exact 1280×800 OS-window capture
+from the real 0.2.2 candidate. In an isolated profile, a real Hermes model called
+`bridge_status`, `bridge_current_url`, and `bridge_read` against the exact
+attached `https://example.com/` Chrome tab. The acceptance required
+session-scoped `INFO … tool … completed` records for all three calls,
+independently verified the exact Chrome URL/title and binding, then opened the
+real side panel and captured only after that proven transcript was visible with
+`Ready · Hermes + Chrome`. SHA-256:
+`8F5DEAA207A2F513D5D9B6C5EF9E88CEBC44C9344209670095A71953AC7D3585`.
+
+The icon, 440×280 tile, 1400×560 marquee, and live capture pass the metadata and
+leakage gates. The old prewritten fixture renderer now writes only under
+`tests/artifacts/` by default and cannot overwrite the public product capture.
+
+The accepted 9.30-second 1920×1080 product video is generated from the same
+proof-gated run after the transcript becomes visible. It shows the exact target,
+the three real Connector tool calls, the real result, and the single authorized
+tab popup without any marketing overlay or fake UI. Three decoded frames are
+checked for valid contrast, the real Tabs open/close transition, and agreement
+with the unobstructed final OS-window capture. SHA-256:
+`DE91F39FC9E5CE225097F255CB620D324B47A436BD9BA034D1C608A4F01F239D`.
 
 ## Remaining external release evidence
 
-- build the exact clean 0.2.1 archives and record their SHA-256 values;
-- publish the matching GitHub 0.2.1 companion before changing the Store item;
-- upload the 0.2.1 Chrome ZIP and updated screenshot to the Store;
+- build the exact clean 0.2.2 archives and record their SHA-256 values;
+- publish the matching GitHub 0.2.2 companion before changing the Store item;
+- upload the 0.2.2 Chrome ZIP and verified replacement screenshot to the Store;
 - complete a pre-submit pass from the exact extracted ZIP in the intended
   signed-in Chrome profile;
-- after publication, confirm the existing Store ID serves 0.2.1 and smoke-test
+- after publication, confirm the existing Store ID serves 0.2.2 and smoke-test
   that Store-installed build.

docs/privacy/index.html

@@ -27,7 +27,7 @@ <h1>Privacy Policy</h1>
   <div class="card"><p>Hermes Connector lets a Hermes agent running on your computer read and control Chrome tabs that you explicitly attach. <strong>Corsen AI does not operate a relay, analytics service, account system, or telemetry endpoint for the extension.</strong></p></div>
   <div class="card"><h2>Data the extension handles</h2><ul>
     <li>Visible website content, accessibility structure, element labels, and requested screenshots from attached tabs.</li>
-    <li>URLs and titles of attached tabs. Opening <strong>Choose tabs</strong> displays current tab titles and URLs locally so you can decide what to attach.</li>
+    <li>URLs and titles of attached tabs. Opening <strong>Tabs</strong> displays current tab titles and URLs locally so you can decide what to attach.</li>
     <li>Instructions from your local Hermes agent and local Hermes profile/session identifiers and titles.</li>
     <li>A random browser identifier, local addresses, tab bindings, and one persistent local Connector pairing credential (Authentication information) stored in Chrome local storage. Only HMAC proofs—not the credential itself—travel to the companion.</li>
     <li>An ephemeral Hermes dashboard session token (Authentication information), read into memory and returned only to that same loopback dashboard HTTP API. It is never stored by the extension.</li>

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Hermes Connector — by Corsen AI",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Attach real Hermes sessions to chosen tabs in your signed-in Chrome profile. Local, unofficial, by Corsen AI.",
   "homepage_url": "https://corsenai.github.io/hermes-connector/",
   "minimum_chrome_version": "120",