@fastbrowse/win32-x64 0.5.19 → 0.5.23

package/fastbrowse/_internal/fastbrowse/browser/capture.js

@@ -2,8 +2,8 @@
 // Unlike snapshot.js (bounded, for Jev's action choice) this reads the whole rendered document, on screen or not,
 // so the reading path and answer-evidence quotes see everything a user could scroll to.
 // Adjacent inline content (text, <strong>, <a>, <span>...) is one block, so a value inside markup stays with its label.
-// biome-ignore format: Python embeds this IIFE inside an expression, where a semicolon is invalid.
-(() => {
+// biome-ignore format: Python embeds this function inside an expression, where a semicolon is invalid.
+((allowedOrigins = null) => {
   if (!document.body) return null;
   const HEADINGS = { H1: 1, H2: 2, H3: 3, H4: 4, H5: 5, H6: 6 };
   const SKIP = new Set(['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEMPLATE', 'SVG', 'CANVAS', 'IFRAME']);
@@ -12,7 +12,34 @@
   let framePath = null;
   let sourcePath = '';
   let inaccessible = 0;
+  let visibleH1 = false;
+  let controlObservations = 0;
+  let imageObservations = 0;
+  let imagesOmitted = false;
+  let linkObservations = 0;
+  let linksOmitted = false;
+  let controlsOmitted = false;
+  const imageSource = source => {
+    if (!source) return source;
+    if (source.startsWith('data:')) {
+      const comma = source.indexOf(',');
+      return `${source.slice(0, comma < 0 ? 128 : Math.min(comma, 128))},[payload omitted]`;
+    }
+    if (source.startsWith('blob:')) return 'blob:[identifier omitted]';
+    return source.length > 1024 ? `${source.slice(0, 1024)}[truncated]` : source;
+  };
   const registry = (window.__fastbrowse ||= { ids: new WeakMap(), nodes: new Map(), next: 1 });
+  const granted = doc => {
+    if (allowedOrigins === null) return true;
+    const frame = doc.defaultView.frameElement;
+    if (frame) {
+      if (frame.hasAttribute('srcdoc') || !frame.getAttribute('src')) return false;
+      const source = new URL(frame.src);
+      if (!['http:', 'https:'].includes(source.protocol) || !allowedOrigins.includes(source.origin)) return false;
+    }
+    const url = new URL(doc.URL);
+    return ['http:', 'https:'].includes(url.protocol) && allowedOrigins.includes(url.origin);
+  };
   const identity = e => {
     if (!registry.ids.has(e)) registry.ids.set(e, registry.next++);
     return registry.ids.get(e);
@@ -34,9 +61,67 @@
     const u = new URL(a.href, location.href);
     return u.origin === location.origin ? u.pathname + u.search : u.href;
   };
-  const push = (kind, text, extra = {}) => {
+  const controlOf = nodes => {
+    let found = null;
+    for (const node of nodes) {
+      if (!clean(node.nodeType === 3 ? node.textContent : (node.innerText ?? node.textContent ?? ''))) continue;
+      let host = node.nodeType === 1 ? node : node.parentElement;
+      while (host && !registry.hoverContexts?.has(host)) host = host.parentElement;
+      if (!host?.isConnected || !host.matches(':hover')) return null;
+      const binding = registry.hoverContexts.get(host);
+      const siblings = [...(host.parentNode?.children || [])];
+      const labelAttributes = [host.getAttribute('role'), host.getAttribute('aria-label'),
+        host.getAttribute('title'), host.querySelector('img[alt]')?.getAttribute('alt') || null];
+      if (host.innerText !== binding.text ||
+          labelAttributes.some((value, index) => value !== binding.labelAttributes[index])) return null;
+      // A reordered or replaced sibling set invalidates the observed ordinal before the quote is taken.
+      if (host.parentNode !== binding.parent || siblings.length !== binding.siblings.length ||
+          siblings.some((sibling, index) => sibling !== binding.siblings[index])) return null;
+      if (found && found !== host) return null;
+      found = host;
+    }
+    return found ? registry.hoverContexts.get(found).control : null;
+  };
+  const listIds = new WeakMap();
+  const listFrameless = new WeakMap();
+  let nextListId = 0;
+  const listContext = nodes => {
+    const lists = new Set();
+    for (const node of nodes) {
+      let element = node.nodeType === 1 ? node : node.parentElement;
+      let list = null;
+      for (let parent = element; parent; parent = parent.parentElement) {
+        if (parent.matches('nav,[role="navigation"]')) return {};
+        if (parent.matches('ul,ol,[role="list"]')) list = parent;
+      }
+      if (!list) {
+        const nested = [...(element?.querySelectorAll('ul,ol,[role="list"]') ?? [])];
+        const outer = nested.filter(candidate => !nested.some(other => other !== candidate && other.contains(candidate)));
+        if (outer.length === 1) list = outer[0];
+      }
+      if (list) lists.add(list);
+    }
+    if (lists.size !== 1) return {};
+    const list = [...lists][0];
+    if (!listIds.has(list)) {
+      listIds.set(list, String(nextListId++));
+      // A frame the capture cannot open elsewhere on the page, such as an advertisement, cannot hold a member of a
+      // list whose element contains no frame; one inside the list, or behind a shadow root the list or anything in it
+      // holds, could.
+      const framed = e => e.tagName === 'IFRAME' || e.tagName === 'FRAME' || !!e.shadowRoot;
+      listFrameless.set(list, !framed(list) && ![...list.querySelectorAll('*')].some(framed));
+    }
+    const members = [...list.querySelectorAll('li,[role="listitem"]')].filter(member => {
+      for (let parent = member; parent && parent !== list; parent = parent.parentElement) {
+        if (hidden(parent)) return false;
+      }
+      return !!textOf(member);
+    });
+    return { list_id: listIds.get(list), list_count: members.length, list_frameless: listFrameless.get(list) };
+  };
+  const push = (kind, text, extra = {}, nodes = []) => {
     if (text)
-      blocks.push({ kind, text, heading_path: [...path], frame_path: framePath, source_path: sourcePath, ...extra });
+      blocks.push({ kind, text, heading_path: [...path], frame_path: framePath, source_path: sourcePath, control_context: controlOf(nodes), ...listContext(nodes), ...extra });
   };
 
   // A cell can say what it says with an image or an icon alone: a flag marking the winner, a tick for "yes".
@@ -168,6 +253,8 @@
     let headers = rows.filter(({ row }) => row.parentElement.tagName === 'THEAD');
     if (!headers.length && rows[0].cells.every(c => c.tagName === 'TH')) headers = [rows[0]];
     const line = ({ cells }) => '| ' + cells.map(c => cellText(c).replace(/\|/g, '\\|')).join(' | ') + ' |';
+    // Headerless comparison rows need leading cells for identity and separate source spans for counting.
+    if (!headers.length) return rows.map((row, index) => (index ? [line(rows[0]), line(row)].join('\n') : line(row)));
     const prefix = headers.map(line);
     if (headers.length) prefix.push('| ' + headers[0].cells.map(() => '---').join(' | ') + ' |');
     const data = rows.filter(row => !headers.includes(row));
@@ -184,8 +271,8 @@
       elements[0].href &&
       clean(elements[0].innerText ?? '') === text;
     for (const e of elements) text = withRating(text, e);
-    if (onlyLink) push('link', text, { href: hrefOf(elements[0]) });
-    else push('paragraph', text);
+    if (onlyLink) push('link', text, { href: hrefOf(elements[0]) }, run);
+    else push('paragraph', text, {}, run);
     for (const e of elements) for (const field of fields(e)) push('paragraph', field);
     run.length = 0;
   }
@@ -197,13 +284,22 @@
   // A classless div repeated three times is usually page layout; a record is a styled unit or a semantic item.
   function repeated(el) {
     if (!el.classList.length && el.tagName !== 'ARTICLE' && el.tagName !== 'LI') return false;
-    return (
-      [...(el.parentNode?.children ?? [])].filter(
+    const siblings = [...(el.parentNode?.children ?? [])].filter(
         sibling =>
           sibling.tagName === el.tagName &&
           sibling.classList.length === el.classList.length &&
           [...el.classList].every(token => sibling.classList.contains(token)),
-      ).length >= 3
+      );
+    if (siblings.length >= 3) return true;
+    // Linked cards can sit inside an unlabelled list wrapper, so distinct destinations establish the pair.
+    if (siblings.length === 2 && el.tagName === 'A' && siblings.every(sibling => sibling.hasAttribute('href'))) {
+      return new Set(siblings.map(sibling => sibling.href)).size === siblings.length;
+    }
+    // A styled pair can be a two-column layout, so require a heading outside both items to name their group.
+    const section = el.parentElement;
+    return (
+      siblings.length === 2 &&
+      [...(section?.querySelectorAll('h1,h2,h3,h4,h5,h6') ?? [])].some(heading => siblings.every(sibling => !sibling.contains(heading)))
     );
   }
 
@@ -237,7 +333,7 @@
         continue;
       }
       if (SKIP.has(node.tagName)) continue;
-      if (!isBlock(node) && recordText(node) === null) {
+      if (!node.matches('nav,[role="navigation"]') && !isBlock(node) && recordText(node) === null) {
         run.push(node);
         continue;
       }
@@ -248,30 +344,38 @@
   }
 
   function block(el) {
+    if (el.matches('nav,[role="navigation"]')) {
+      // Navigation help headings describe their menu, not product facts in the following main content.
+      const surrounding = [...path];
+      walk(el);
+      path = surrounding;
+      return;
+    }
     const level = HEADINGS[el.tagName];
     if (level) {
       const text = textOf(el);
       while (path.length >= level) path.pop();
       if (text) {
-        push('heading', text);
+        push('heading', text, {}, [el]);
         path.push(text);
       }
       return;
     }
     if (el.tagName === 'TABLE') {
-      for (const text of renderTable(el)) push('table', text);
+      for (const text of renderTable(el)) push('table', text, {}, [el]);
       // A form laid out in a table: its cells render as text, which holds none of the controls' values.
       for (const field of fields(el)) push('paragraph', field);
       return;
     }
-    if (el.tagName === 'PRE') return push('code', textOf(el));
+    if (el.tagName === 'PRE') return push('code', textOf(el), {}, [el]);
     const record = recordText(el);
     if ((el.tagName === 'LI' && leaf(el)) || record !== null) {
-      const links = el.querySelectorAll('a[href]');
+      const links = el.matches('a[href]') ? [el] : el.querySelectorAll('a[href]');
       push(
         el.tagName === 'LI' ? 'list_item' : 'record',
         record ?? withRating(textOf(el), el),
         links.length === 1 ? { href: hrefOf(links[0]) } : {},
+        [el],
       );
       for (const field of fields(el)) push('paragraph', field);
       return;
@@ -296,7 +400,7 @@
     } catch {
       inner = null;
     }
-    if (!inner?.body) {
+    if (!inner?.body || !granted(inner)) {
       inaccessible++;
       return;
     }
@@ -310,6 +414,77 @@
     framePath = frame;
     sourcePath = source;
     walk(root);
+    path = [...headings];
+    const visible = e => e.checkVisibility ? e.checkVisibility({ visibilityProperty: true }) : !hidden(e);
+    for (const e of [...root.querySelectorAll('input,select,textarea,button,[role="button"]')].filter(visible)) {
+      if (controlObservations >= 64) {
+        if (!controlsOmitted) push('observation', 'Additional control state observations omitted.');
+        controlsOmitted = true;
+        break;
+      }
+      // Placeholders suggest input; they do not label a value or prove an empty named field.
+      if (CONTROLS.has(e.tagName) && !e.labels?.length && !e.hasAttribute('aria-label') && !e.hasAttribute('aria-labelledby')) continue;
+      const name = nameOf(e) || clean(e.innerText ?? '');
+      if (!name || e.dataset?.fastbrowseSecret === '1') continue;
+      if (CONTROLS.has(e.tagName) && !UNFILLED.has(e.type) && !fieldValue(e)) {
+        push('observation', `${name.slice(0, 1024)}: [empty]`);
+        controlObservations++;
+      }
+      if (controlObservations < 64 && e.matches(':disabled,[aria-disabled="true"]')) {
+        push('observation', `${name.slice(0, 1024)}: disabled`);
+        controlObservations++;
+      }
+    }
+    // Images carry no innerText, so a text-only capture cannot distinguish their presence from absence.
+    for (const image of [...root.querySelectorAll('img')].filter(visible)) {
+      if (imageObservations++ >= 32) {
+        if (!imagesOmitted) push('observation', 'Additional visible image metadata omitted.');
+        imagesOmitted = true;
+        break;
+      }
+      // Loading changes without a page edit, so captures report presence rather than transient decode state.
+      const metadata = { alt: image.getAttribute('alt')?.slice(0, 1024) ?? null,
+        src: imageSource(image.getAttribute('src') ?? image.getAttribute('srcset')) };
+      push('observation', `Image element DOM metadata: ${JSON.stringify(metadata)}. Pixels are not described.`);
+    }
+    // A link drawn only as an icon has no text, so its destination, the one thing it says, was nowhere a reader
+    // could quote: asked for a release's download URL beside an icon-only download link, a run read every other
+    // field of the row and then clicked the link again and again looking for the address. The row's text names
+    // which item the link belongs to, since the observation is not read where the link stands.
+    for (const link of [...root.querySelectorAll('a[href]')].filter(visible)) {
+      if (clean(link.innerText ?? '')) continue;
+      // An icon button written as `href="#"` or a script URL runs code here and leads nowhere to report. A bare
+      // `#` parses to an empty hash, so the raw attribute says it is a fragment link, not the parsed URL.
+      let target;
+      try {
+        target = new URL(link.getAttribute('href'), location.href);
+      } catch {
+        // One malformed address must not cost the page its whole capture.
+        continue;
+      }
+      const page = location.href.split('#')[0];
+      const fragment = link.getAttribute('href').trim().startsWith('#') || (target.hash && target.href.split('#')[0] === page);
+      if (target.protocol === 'javascript:' || fragment) continue;
+      if (linkObservations++ >= 32) {
+        if (!linksOmitted) push('observation', 'Additional link destinations omitted.');
+        linksOmitted = true;
+        break;
+      }
+      let row = link.parentElement;
+      while (row && row !== root && !clean(row.innerText ?? '')) row = row.parentElement;
+      const metadata = {
+        label: (nameOf(link) || drawn(link)).slice(0, 256) || null,
+        href: imageSource(link.href),
+        near: row ? textOf(row).replace(/\s+/g, ' ').slice(0, 256) || null : null,
+      };
+      push('observation', `Link element DOM metadata: ${JSON.stringify(metadata)}. The link has no text.`);
+    }
+    const h1 = [...root.querySelectorAll('h1,[role="heading"][aria-level="1"]')].filter(visible);
+    visibleH1 ||= h1.length > 0;
+    if (root === document.body) {
+      const doc = document.documentElement;
+      push('observation', `Observed viewport: Horizontal overflow: ${doc.scrollWidth > doc.clientWidth ? 'yes' : 'no'}`);
+    }
     for (const e of root.querySelectorAll('*')) {
       if (e.shadowRoot) scope(e.shadowRoot, frame, `${source}/shadow:${identity(e)}`);
       // A frame the walk never reached (hidden, or inside a record or table read as one block) is still read.
@@ -319,5 +494,6 @@
   }
 
   scope(document.body, null, '');
-  return { url: location.href, title: document.title, blocks, inaccessible_frames: inaccessible };
-})()
+  if (!visibleH1) push('observation', 'Observed accessible DOM: Visible h1 headings: 0');
+  return { url: location.href, title: document.title, blocks, inaccessible_frames: inaccessible, visible_h1: visibleH1 };
+})

package/fastbrowse/_internal/fastbrowse/browser/snapshot.js

@@ -3,7 +3,18 @@
 // Adapted to fastbrowse's Control shape (role + operation set, not per-kind actions) and to traverse
 // open shadow roots. Runs once per frame session (main frame or an OOPIF); the Python side merges frames.
 // biome-ignore format: Python appends mode arguments to this parenthesized expression.
-(mode => {
+((mode, allowedOrigins = null) => {
+  const granted = doc => {
+    if (allowedOrigins === null) return true;
+    const frame = doc.defaultView.frameElement;
+    if (frame) {
+      if (frame.hasAttribute('srcdoc') || !frame.getAttribute('src')) return false;
+      const source = new URL(frame.src);
+      if (!['http:', 'https:'].includes(source.protocol) || !allowedOrigins.includes(source.origin)) return false;
+    }
+    const url = new URL(doc.URL);
+    return ['http:', 'https:'].includes(url.protocol) && allowedOrigins.includes(url.origin);
+  };
   // Form context is repeated for each submit-capable input in safety prompts.
   const FORM_TEXT_CHARS = 2000;
   // Freshness guards bound comparison work on large cards; this text is never sent to a model.
@@ -30,6 +41,10 @@
     return true;
   };
   const registry = (window.__fastbrowse ||= { ids: new WeakMap(), nodes: new Map(), next: 1 });
+  // Keep the page's own timer overrides from holding a browser-side frame wait open.
+  registry.nativeSetTimeout ||= window.setTimeout.bind(window);
+  registry.nativeClearTimeout ||= window.clearTimeout.bind(window);
+  registry.nativeRequestAnimationFrame ||= window.requestAnimationFrame.bind(window);
   // What was offered to be acted on; `ids` also names hover targets and fingerprinted nodes.
   registry.controls ||= new WeakSet();
   // A visible loading indicator means the page is still fetching what it will draw, which network idle and a
@@ -117,7 +132,7 @@
           } catch {
             inner = null;
           }
-          if (inner?.body) include(inner);
+          if (inner?.body && granted(inner)) include(inner);
         }
       }
     };
@@ -165,10 +180,56 @@
   registry.visible = visible;
   // Styled checkboxes and radios often hide the native input. Its visible label is the click
   // target, but the input still owns the checked/disabled state and must participate in freshness.
-  const sourceOf = e => (e.tagName === 'LABEL' && ['checkbox', 'radio'].includes(e.control?.type) ? e.control : e);
+  const sourceOf = e => (e.tagName === 'LABEL' && ['checkbox', 'radio', 'file'].includes(e.control?.type) ? e.control : e);
 
   // Their text is code, not a name: Amazon nests a <style> inside a result card's link.
   const CODE = new Set(['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEMPLATE']);
+  // Icon-only buttons hide their glyph from accessibility text, but the icon library still names it: in a class,
+  // a sprite reference, a data attribute, an svg title or a ligature. A gallery's trash control otherwise reads
+  // "button" beside an edit link that reads "link", and the choice cannot tell removing an image from editing it.
+  const ICON_CLASS =
+    /^(?:icon-tabler|tabler-icon|lucide|glyphicon|fa|fas|far|bi|mdi|icon|ti|la|ri|ion|feather)-([a-z][a-z0-9-]{0,47})$/;
+  // Sizes, weights and effects share an icon library's prefix without naming a glyph, as does the library itself.
+  const ICON_STYLE =
+    /^(?:icon|tabler|solid|regular|light|thin|duotone|brands|xs|sm|lg|xl|\d+x|fw|spin|pulse|border|inverse|stack.*|pull-.*|rotate-.*|flip-.*)$/;
+  const glyphName = text => {
+    const name = (text || '').trim().toLowerCase().replace(/^(?:icons?|ico|ic|svg|sprite)[-_]/, '');
+    return /^[a-z][a-z0-9_-]{0,47}$/.test(name) && !ICON_STYLE.test(name) ? name : '';
+  };
+  const iconLabel = e => {
+    const glyphs = new Set();
+    for (const icon of e.querySelectorAll('svg,i,span,[role="img"]')) {
+      if (!icon.checkVisibility({ checkOpacity: true, checkVisibilityCSS: true })) continue;
+      const named = [];
+      for (const token of icon.classList) {
+        const glyph = ICON_CLASS.exec(token);
+        if (glyph && !ICON_STYLE.test(glyph[1])) named.push(glyph[1]);
+      }
+      const use = icon.localName === 'svg' && icon.querySelector('use');
+      const sprite = use && (use.getAttribute('href') || use.getAttribute('xlink:href') || '');
+      if (sprite) named.push(glyphName(sprite.split('#').pop().split('/').pop().replace(/\.svg$/, '')));
+      named.push(glyphName(icon.getAttribute('data-icon')));
+      // A ligature font draws the glyph its text names, and the icon is hidden so readers skip that word.
+      if ([...icon.classList].some(token => /^material-(?:icons|symbols)/.test(token))) {
+        named.push(glyphName(icon.textContent.replace(/\s+/g, '_')));
+      }
+      const title =
+        icon.getAttribute('aria-label') || (icon.localName === 'svg' ? icon.querySelector(':scope > title')?.textContent : '');
+      if (title?.trim()) glyphs.add(title.replace(/\s+/g, ' ').trim());
+      else for (const name of named) if (name) glyphs.add(`${name.replace(/[-_]/g, ' ')} icon`);
+    }
+    return glyphs.size === 1 ? [...glyphs][0] : '';
+  };
+  // An accessible description is what an unnamed control has left that says what it does.
+  const describedBy = e => {
+    const root = typeof e.getRootNode === 'function' ? e.getRootNode() : document;
+    return (e.getAttribute('aria-describedby') || '')
+      .split(/\s+/)
+      .map(id => (id && (root.getElementById ? root.getElementById(id) : document.getElementById(id))?.textContent) || '')
+      .map(text => text.replace(/\s+/g, ' ').trim())
+      .filter(Boolean)
+      .join(' ');
+  };
   const labelOf = (e, seen = new Set()) => {
     if (!e || seen.has(e)) return '';
     seen.add(e);
@@ -233,7 +294,7 @@
   const DATE_TYPES = ['date', 'datetime-local', 'month', 'week', 'time'];
 
   const roleOf = e => {
-    if (sourceOf(e) !== e) return sourceOf(e).type;
+    if (sourceOf(e) !== e) return sourceOf(e).type === 'file' ? 'textbox' : sourceOf(e).type;
     const explicit = e.getAttribute('role');
     if (ARIA_ROLES.includes(explicit)) return explicit;
     if (e.tagName === 'BUTTON' || e.tagName === 'SUMMARY') return 'button';
@@ -259,6 +320,7 @@
 
   const submitSemantics = e => {
     const form = e.form;
+    const explicit = ['BUTTON', 'INPUT'].includes(e.tagName) && ['submit', 'image'].includes(e.type);
     const implicit = [
       'text',
       'search',
@@ -273,8 +335,8 @@
       'datetime-local',
       'number',
     ];
-    if (!form || e.tagName !== 'INPUT' || !implicit.includes(e.type)) return null;
-    const submit = [...form.getRootNode().querySelectorAll('button,input')].find(
+    if (!form || (!explicit && (e.tagName !== 'INPUT' || !implicit.includes(e.type)))) return null;
+    const submit = explicit ? e : [...form.getRootNode().querySelectorAll('button,input')].find(
       c => c.form === form && (c.type === 'submit' || c.type === 'image'),
     );
     if (submit?.matches(':disabled')) return null;
@@ -311,7 +373,7 @@
         } catch {
           inner = null;
         }
-        if (inner && inner.body) yield* walk(inner);
+        if (inner && inner.body && granted(inner)) yield* walk(inner);
         else inaccessible++;
       }
     }
@@ -342,11 +404,15 @@
       e.ownerDocument.location.origin,
       e.ownerDocument.defaultView.performance.timeOrigin,
       submitSemantics(e),
+      source.getAttribute('name'),
+      source.getAttribute('autocomplete'),
       identity(source),
     ];
   };
 
   const controls = [];
+  // Controls with no accessible name of their own, whose label is an icon's or only their role.
+  const unnamed = new Set();
   const fieldScope = e => {
     if (!e.matches('input,textarea,select')) return null;
     const form = e.form || e.closest('form,fieldset,[role="form"]');
@@ -376,16 +442,28 @@
       rname = roleOf(e);
     if (!rname || r.width <= 0 || r.height <= 0 || x < 0 || x >= innerWidth) continue;
     if (rname === 'gridcell' && e.querySelector('button,[role="button"]')) continue;
+    // A button-styled link offers the same label twice, but its inner button owns every useful click point.
+    if (rname === 'link') {
+      const nested = e.querySelectorAll(SELECTOR);
+      const button = nested.length === 1 ? nested[0] : null;
+      if (button?.tagName === 'BUTTON' && visible(button) && !button.matches(':disabled') &&
+          !button.closest('[aria-disabled="true"],[inert]') && labelOf(button) === labelOf(e)) continue;
+    }
+
     const id = identity(e);
     registry.controls.add(e);
+    const named = labelOf(e);
+    if (!named) unnamed.add(id);
     const base = {
       id,
       role: rname,
-      label: labelOf(e) || rname,
+      label: named || iconLabel(e) || describedBy(e) || rname,
       offscreen: y < 0 || y >= innerHeight,
       distance: y < 0 || y >= innerHeight ? 1 + Math.abs(y - innerHeight / 2) : 0,
       sensitive: secret(source),
       input_type: source.type || null,
+      input_name: source.getAttribute('name') || null,
+      autocomplete: source.getAttribute('autocomplete') || null,
       frame_origin: e.ownerDocument.location.origin,
       frame_path: framePath(e.ownerDocument),
       form_id: fieldScope(source),
@@ -396,6 +474,8 @@
       base.href = u.origin === location.origin ? u.pathname + u.search : u.host + u.pathname;
       // The page's own word for "the next page of this list", which survives an icon label or another language.
       if (e.rel && e.rel.split(/\s+/).includes('next')) base.next_page = true;
+      // The page's own word that this link saves a file, which a task ruling out downloads has to see before a click.
+      if (e.hasAttribute('download')) base.download = true;
     }
     for (const key of ['checked', 'selected', 'expanded']) {
       const value = e.getAttribute('aria-' + key);
@@ -419,7 +499,7 @@
       base.operations = ['select'];
       base.options = [...e.options].filter(o => !o.disabled && !o.closest('optgroup[disabled]')).map(o => o.label);
       base.value = [...e.selectedOptions].map(o => o.label).join(', ');
-    } else if (e.type === 'file') {
+    } else if (source.type === 'file') {
       base.operations = ['upload'];
       base.value = null;
     } else {
@@ -496,6 +576,9 @@
     for (let e = element.parentElement; e && e !== e.ownerDocument.body; e = e.parentElement) {
       if (twins.some(twin => twin !== element && e.contains(twin))) break;
       scope = e;
+      // A lone open reply has no form twin nearby; crossing its record picks a different commenter's name.
+      if (e.matches('article,li,[role="listitem"]') ||
+        (e.matches('tr,[role="row"]') && e.querySelector('input,textarea,select,[role="textbox"]'))) break;
     }
     return scope ? excerpt(nameOf(scope, element, label, nearest), CONTROL_CONTEXT_CHARS) : '';
   };
@@ -503,7 +586,7 @@
   // operation. An element whose hover rule would reveal something now hidden is offered as a hover target.
   const docs = [];
   const addDoc = doc => {
-    if (!doc?.body || docs.includes(doc)) return;
+    if (!doc?.body || !granted(doc) || docs.includes(doc)) return;
     docs.push(doc);
     for (const frame of doc.querySelectorAll('iframe,frame')) {
       try {
@@ -581,12 +664,14 @@
         } catch {
           continue;
         }
-        if (!hidden) continue;
+        // Removing the active hover target renumbers its identical siblings and sends the next choice
+        // to a different element. Keep it offered while the pointer still reveals its content.
+        if (!hidden && !e.matches(':hover')) continue;
         const image = e.querySelector('img[alt]');
         const label =
-          firstLine(e.innerText) ||
           e.getAttribute('aria-label') ||
           image?.getAttribute('alt') ||
+          firstLine(e.innerText) ||
           e.getAttribute('title') ||
           e.tagName.toLowerCase();
         const role =
@@ -664,6 +749,58 @@
     }
   }
 
+  // An unnamed control the page draws once per card, a trash icon beside each image, is a twin only while another
+  // card shows the same icon: one left alone, or drawn by another icon set, would name no card and leave the choice
+  // guessing which image it removes. It is named by the card that holds it, or failing one by the nearest ancestor
+  // that says anything besides it.
+  // A card is an item, a row, or an element the page repeats beside itself with the same tag and class.
+  const isCard = e =>
+    e.matches('article,li,[role="listitem"],tr,[role="row"]') ||
+    (!!e.getAttribute('class') &&
+      [...(e.parentElement?.children || [])].some(
+        s => s !== e && s.localName === e.localName && s.getAttribute('class') === e.getAttribute('class'),
+      ));
+  const nearestName = (element, label) => {
+    let first = '';
+    for (let e = element.parentElement, path = element; e && e !== e.ownerDocument.body; path = e, e = e.parentElement) {
+      first ||= nameOf(e, element, label, true);
+      if (!isCard(e)) continue;
+      // An action row's own caption ("Actions") is the first text the climb meets and names no item, so the card
+      // is named by what it holds outside the row that holds the control.
+      const aria = (e.getAttribute('aria-label') || '').trim();
+      const outside = [...e.children]
+        .filter(child => child !== path)
+        .map(child => firstLine(child.innerText))
+        .find(line => line && line !== label && !repeated.has(line));
+      return excerpt((aria !== label && aria) || outside || first, CONTROL_CONTEXT_CHARS);
+    }
+    return excerpt(first, CONTROL_CONTEXT_CHARS);
+  };
+  for (const c of controls) {
+    if (!c.context && unnamed.has(c.id)) {
+      const context = nearestName(registry.nodes.get(c.id), c.label);
+      if (context) c.context = context;
+    }
+  }
+
+  // A revealed caption needs its actual container association, not merely the most recent action.
+  registry.hoverContexts = new WeakMap();
+  for (const c of controls) {
+    if (!c.operations.includes('hover')) continue;
+    const element = registry.nodes.get(c.id);
+    registry.hoverContexts.set(element, {
+      control: {
+        role: c.role, label: c.label,
+        context: /^\d+ of \d+$/.test(c.context || '') ? c.context : null,
+      },
+      labelAttributes: [element.getAttribute('role'), element.getAttribute('aria-label'),
+        element.getAttribute('title'), element.querySelector('img[alt]')?.getAttribute('alt') || null],
+      text: element.innerText,
+      parent: element.parentNode,
+      siblings: [...(element.parentNode?.children || [])],
+    });
+  }
+
   // A date field's own label ("Start Date") rarely says which picker it belongs to when a page offers several
   // ("Date Picker 3"): unlike a colliding label, a uniquely named one never reaches the loop above, so the
   // nearest ancestor that names a section is attached here on its own, without the twin-avoidance `contextOf`
@@ -777,7 +914,7 @@
       } catch {
         inner = null;
       }
-      if (!inner) continue;
+      if (!inner || !granted(inner)) continue;
       const f = frame.getBoundingClientRect();
       readText(inner, dx + f.left + frame.clientLeft, dy + f.top + frame.clientTop);
     }