Module browser_allowlist 

The sites an agent limited its browser pane to with OpenBrowser({allowed_origins}) (docs/specs/SPEC_BROWSER_PANE_ALLOWED_ORIGINS_2026_10_09.md).

One list per chain of panes: the pane OpenBrowser opened (the root) and every popup pane opened from it, or from those. Like the owner map, this is srv’s own record, in memory: the block’s browser:allowed_origins meta key mirrors it for the pane’s header, and clients can’t write it. The host keeps a copy of every member’s list, pushed with the owned-pane set (browser_host_sync), and stops navigations off it.

Structs

Lists 🔒

Constants

ALLOWED_META_KEY 🔒

Block meta key mirroring a pane’s list, for its header.

Functions

allow 🔒

Add origin to pane’s chain’s list: the person allowed it. Returns the list after, and the chain’s members, whose header shows it.

drop_pane 🔒

pane was closed or taken over: it leaves its chain. The others keep the list, even when pane was the root: a popup pane can outlive its opener and still be the agent’s, and must not lose its limit with it. The list goes when its last pane does. Returns whether pane had a list.

handle_host_browser_navigation 🔒

POST /api/v1/host/browser_navigation — the host stopped a navigation off a pane’s site list (allowed-origins spec §4). Body {pane, target, url, kind}: pane is the pane the list belongs to, target the pane or popup window that was navigating, kind navigate (replayed on Allow) or popup (not: the person or agent clicks again). Only the host calls it. Answers at once; the question runs on its own.

join 🔒

pane, a popup pane opener just opened, joins opener’s chain, if it has a list. Returns the list it now shares.

limit_new_pane 🔒

Limit pane, which OpenBrowser just opened, to list if one was given, and send it to the host at once, not on the next sync: the host must have it before the pane’s first navigation can leave it.

list_for 🔒

pane’s list, if its chain has one.

list_for_open 🔒

Check OpenBrowser’s allowed_origins: None when not given, the list in its normal form when it is, or why it can’t be used.

lists 🔒

lock 🔒

mirror 🔒

Mirror a new pane’s list (if any) into the meta it’s created with.

opener_list 🔒

The site list of the pane pane was opened from as a popup, from srv’s own records (browser:popup_of, which only srv writes). Covers the moment between a popup pane opening and joining its chain: a navigation the host stopped then is still asked about, not replayed.

publish 🔒

Write list (or nothing) to each of panes’ headers.

refuse_agent_navigation 🔒

Why an agent’s own BrowserNavigate of pane to url is refused, if it is: the pane is limited to some sites and url isn’t on them (§3).

refuse_popup 🔒

Why a popup pane to url from opener isn’t opened, if it isn’t: the host asks before offering one off the opener’s list, and this checks again from srv’s own record.

replay_navigation 🔒

Load url in target (a pane or popup window), as the navigation the host stopped would have. A plain load: a form’s data isn’t sent again.

set 🔒

Limit root (a pane OpenBrowser just opened) to list.

settle_popup_pane 🔒

pane, a popup pane that joined its opener’s chain (list) as soon as it opened, once its ownership is settled: with an owner it shares the chain’s limit, in its header and on the host; with none (the opener was taken over meanwhile) it leaves the chain. The host push waits until here, so nothing yields between opening the pane and settling who owns it.

snapshot 🔒

Every member pane’s list, for the host.