0.3.0 made Chervil a browser you could live in. 0.3.1 is where Sprig starts to act — and where we put the guardrails on before handing it any keys.
Sprig does things — with authority in the right place
Ask Sprig to do something on a live website and it now plans the task first (you'll see a "📋 Plan"), then works through it step by step. The important part isn't that it acts — it's what sits between the model deciding and the action happening.
Every action passes through a deterministic control layer:
- A fixed registry of allowed action types — anything unknown is refused outright.
- An allow / confirm / deny decision on each step. Safe things just happen; state-changing things ask first; payments, logins, and anything destructive are always blocked — no matter how confident the model is.
- A 🛡 activity log recording every action and how it was decided, so "unauthorized" is detectable, not just hoped-against.
And because nobody wants to click "approve" forty times, you can Allow an action for the whole task — scoped to that run, still audited.
This is the principle we keep coming back to: the model proposes; a separate layer disposes. Authority lives in the runtime, never in the model's reasoning. (The full design is RFC 0006 in the repo.) The first guarded OS actions ship too — Sprig can open a link in your real browser or your Downloads folder, each behind a confirm and a strict allowlist. No arbitrary commands, ever.
The everyday extras
- Find in page (Ctrl+F) — real sites get native find with a match count; composed pages search too.
- Reopen closed tab (Ctrl+Shift+T) — with its full conversation and pages intact.
- Form autofill — save your details in Settings → You, then on any site just say "fill the form." Passwords and card details are never stored or filled.
And a fix that matters
If you attached a big file and Sprig seemed to ignore most of it — that was real. Text attachments were silently truncated to the first 30,000 characters, so a large CSV or document reached Sprig as a thin slice of the top, and it would confidently summarize that as if it were the whole thing. (A reader caught it when a family-tree CSV's Scottish ancestors — thousands of rows deep — kept coming back as "all American.")
Now attachments allow ~500,000 characters, and when a file is still larger, Sprig is told it's truncated and says so instead of pretending the visible part is complete. Big files finally get read.
Still free, still yours
All of this — the agentic actions, the browser, autofill, attachments — is free and local, on your own AI keys. Chervil Pro is only for the hosted side (shareable links, your public profile, analytics).
Download Chervil 0.3.1, point Sprig at a real site, and ask it to do something — and watch it ask permission before it does anything that matters.
More soon.