Site permissions
Every site gets one of three tiers: deny, read or full. The extension checks it before any command touches a tab, so neither the agent nor the daemon can skip it.
The default is full everywhere. Tighten the sites you care about, or flip the default and grant sites back one by one.
Tiers
| deny | Nothing. Every command against the site fails, and its tabs appear redacted in reins tabs: tab id only, no URL or title. |
|---|---|
| read | Reading only. snapshot, text, screenshot, console, network and wait all work. click, type, navigate, eval, and everything else that acts on the page is blocked. |
| full | Everything, including navigation, interaction, eval and raw CDP. |
reins nav and reins open need full on both the current and the destination site.
Rules and matching
- A rule is a bare host (
github.com) or a wildcard (*.google.com) paired with a tier. - An exact host match beats a wildcard. The longest wildcard suffix wins among wildcards. Anything unmatched gets the default tier.
*.foo.comcovers subdomains and the apexfoo.com, following Chrome's match-pattern convention.- Pages without an http(s) host (
chrome://pages,about:blank) are governed by the default tier. - Policy is stored per browser profile, so a locked-down work profile and a permissive scratch profile coexist naturally.
Granting and tightening
Grant access in the extension popup, under Site permissions. An agent in your shell cannot click it, which is the point. The CLI can only look and tighten:
$ reins policy # default, rules, tier per open tab$ reins policy readonly "*.github.com" # reading only, no acting$ reins policy deny mybank.com # off limits entirely$ reins policy allow mybank.com # always errors: grants live in the popup
What a blocked agent sees
A blocked command fails with policy_denied and says what to do:
blocked by policy: mybank.com is read-only. Grant full access from thereins extension popup
It exits nonzero, so agents pass the message on instead of retrying.