PawWork

PawWork is a Chrome MV3 extension, loaded unpacked rather than installed from the Web Store, that treats the browser you are already logged into as the machine an agent works on. The order of operations is the point: you select a region of the live page first, and that selection becomes user-owned context — one of the environment groups the side panel holds as selections, clipboard pins and page items, which only the interface may change and which the model’s tools are explicitly forbidden to mutate. You then describe the outcome, and a tool loop in an offscreen document aims its inventory at what the session actually holds — inspect, acquire, run, clarify, action, task, sheet, doc, web — before calling your own OpenAI-compatible model. Deliverables are files you can keep editing: sheets, Univer documents and site HTML open in preview tabs, and the session store, the model loop and the sandbox that runs model-written JavaScript all live inside the extension. No package.json and no build step, no hosted model and no server.

Who built itThe account behind 17 of the repository’s 20 commits, all of them in September 2026; two of those were made under the name 0xYN from the same email address. A Cursor agent accounts for one commit, an address at ByteDance for one, and a workflow bot for the last. 15 of the 20 commits carry a co-author trailer and 14 of those name Cursor. The recon report carries no profile text, follower count or other biography for the owner.

1. 01

   Three unpacked builds in fifty minutes, then a version number

   The repository was created on 2026-08-28 and everything in it happened in September: 20 commits between 2026-09-01 and 2026-09-17, the oldest a release build and the newest adding durable tasks and live-page tab leases. Six releases came out of that run. Four are named after their commits and all four landed on 2026-09-01 — unpacked-9829868 at 01:59:49, unpacked-f2a02f0 at 02:07:37, unpacked-af56da4 at 02:49:04 and unpacked-570482b at 15:03:12 — three builds inside fifty minutes, then eight hours to the fourth; after that came v1.0.0-unpacked on 2026-09-09 and v1.1.0 on 2026-09-16. Around them sit 2,881 stars, 10 forks, 5 watchers, 0 open issues, MIT, JavaScript and 17,773 KB. 15 of the 20 commits carry a co-author trailer, 14 of them naming Cursor, and the contributor list has three entries: the owner with 17 commits, a Cursor agent with one and a workflow bot with one. The names in the materials do not line up: the repository the report describes is Player-YN/BrowserKitten, while the README is titled with a Chinese name followed by PawWork, the release titles say “Paw Work unpacked”, and AGENTS.md records the origin as PawWork_ZhuaZhua.git. BrowserKitten appears nowhere in those documents, and the older name PageWand survives in chrome.storage.local keys while message targets are still prefixed pawwork-.

2. 02

   The selection is the interface, and the model does not own it

   The project calls itself selection-first, and the code for it sits at both ends of the extension. On the page side, src/content_script.js — 183,745 bytes, registered on all URLs in all frames — does what AGENTS.md calls reaching out a paw to select, plus a per-frame action snapshot and mutate. On the session side a selection is not prompt text but a domain object: Group + WebItem is described as the environment context the user owns, listing selections, clipboard pins and page items, and the architecture document puts the rule plainly — only the interface RPC may change it, and the tools are forbidden from mutating a SelectionGroup. The model can read the context the user assembled but cannot quietly rewrite it, and the tool loop is aimed rather than exhaustive: sendMessage builds its inventory from what the session actually holds, in the document’s phrase aiming rather than hiding tools. That inventory is inspect, acquire, run, clarify, action, task, sheet, doc and web, chosen by an AI SDK 7 ToolLoopAgent, and sys is deliberately not among them — it is called from inside code that run executes. How the selected DOM reaches the model is not covered by the materials: the tree shows a 16,856-byte pickContext.js and an 11,440-byte pageItems.js among the other context modules, but src/AGENTS.md, which explains that transport, is not part of the recon report.

3. 03

   The file comes back as a canvas you keep editing

   What the user gets at the end is not an answer but an artefact: the architecture document defines an Artifact as a session deliverable — sheet, Univer document, site HTML or file — created by run, by the office tools or by the interface. The tree shows where that work lives: officeTools.js at 33,341 bytes, sheetApply.js at 45,764 and pptxExport.js at 25,344 inside the session workspace, plus docExport.js, sheetCodec.js and a 60,164-byte sheet.js in the preview tabs, next to tracked Univer bundles of 12,984,218 bytes for sheets and 8,939,175 for documents. Three canvas kinds exist: sheet, doc, and web marked with data-paw-kind=site; the document is explicit that there is no Design or Slides canvas, even though the topics mention tldraw and a pptx module exists. Which code writes the Office container itself is not covered by the materials. The one format-level detail they carry is a bug: a pull request from 2026-09-15 reports that saving a TSV sheet whose cell held a tab character wrote the tab as a separator, so reopening it split one cell into two columns and shifted every value after it. The fix quotes tab-bearing values in the shared CSV/TSV escaper, and the regression runs the production aoaToCsv to parseDelimited round trip: on the unchanged base the new test fails, turning three values into four, and with the fix the suite reports 16 passed, 0 failed.

4. 04

   No server, no hosted model, and a guest with no chrome

   The product does everything inside the browser. The extension has no package.json and no build step; the only script outside it is a 2,822-byte Python packer that turns the tracked manifest.json, icons/ and src/ into a release folder and a zip, which is how it ships. There is no hosted model and no proxy either: the user pastes an OpenAI-compatible key into the side panel and it is stored in chrome.storage.local, while the offscreen document starts without one because the model is resolved only when a message is sent. Model-written JavaScript gets none of the extension’s privileges: it runs as a guest in a QuickJS sandbox declared through manifest.sandbox (a 4,076-byte src/sandbox/runtime.js), embedded as an iframe by the offscreen document, with no chrome.* at all; to reach the browser it calls a sys ABI covering tabs, eval, fetch, cdp, download and screenshot, served by the service worker; the userScripts and debugger permissions exist only for it. The guest runs whatever the model writes, and the bundling happens in the browser: a 45,789-byte runtime pulls a 13,978,850-byte esbuild wasm, a 902,483-byte QuickJS loader and a 1,162,837-byte AI SDK loader out of the tracked vendor directory, so agent code runs with no toolchain on the machine. The recon report records no server, deployment or container file in the tree.

5. 05

   The friction the author called self-inflicted, and limits written down as limits

   The most revealing document in the repository is the pull request that added two sandbox primitives on 2026-09-16. Its background says the author analysed a real trajectory, a conversation with a logged-in chat page, and found the agent spending most of its effort fighting its own sandbox rather than doing what no other tool could. The guest is QuickJS and has no timers, so waiting meant pushing sleep logic into page-evaluated code, and every evaluation was capped at about twenty seconds, so one streaming read had to be split into repeated short evaluations with hand-rolled sleeps. The author’s verdict is that this friction was self-inflicted rather than a physical limit, and the fix was two ABI primitives: a guest-level sleep the host provides, and a wait-for call polling inside the page with the page’s own timers, which escapes the per-evaluation cap, waits up to 120 seconds and can hold until a changing value settles. Sending a message and reading a streamed reply went from roughly ten runs to one send and one wait. The boundary section is written the same way, calling its limits limits rather than a to-do list: no durable per-call journal, tab leases held only in service worker memory and lost with it, and no way out of the browser at all — no native system control, no local commands, and, in the project’s words, no verified high-fidelity Office round trip.