@quanta-intellect/vessel-browser 0.1.132 → 0.1.134

package/out/main/index.js

@@ -114,7 +114,7 @@ const defaults = {
 const SAVE_DEBOUNCE_MS$6 = 150;
 const CHAT_PROVIDER_SECRET_FILENAME = "vessel-chat-provider-secret";
 const CODEX_TOKENS_FILENAME = "vessel-codex-tokens";
-const logger$v = createLogger("Settings");
+const logger$x = createLogger("Settings");
 const SETTABLE_KEYS = new Set(Object.keys(defaults));
 let settings = null;
 let settingsIssues = [];
@@ -139,7 +139,7 @@ function canUseSafeStorage$1() {
   try {
     return electron.safeStorage.isEncryptionAvailable();
   } catch (err) {
-    logger$v.warn("safeStorage.isEncryptionAvailable() failed, assuming unavailable:", err);
+    logger$x.warn("safeStorage.isEncryptionAvailable() failed, assuming unavailable:", err);
     return false;
   }
 }
@@ -148,7 +148,7 @@ function writePrivateFile(filePath2, data) {
   try {
     fs.chmodSync(filePath2, 384);
   } catch (err) {
-    logger$v.debug("Could not chmod private file (non-POSIX filesystem):", err);
+    logger$x.debug("Could not chmod private file (non-POSIX filesystem):", err);
   }
 }
 function assertSafeStorageAvailable() {
@@ -167,7 +167,7 @@ function readStoredProviderSecret() {
     }
   } catch (err) {
     if (!isMissingFileError(err)) {
-      logger$v.warn("Could not read stored provider secret:", err);
+      logger$x.warn("Could not read stored provider secret:", err);
     }
   }
   return null;
@@ -185,7 +185,7 @@ function clearStoredProviderSecret() {
     fs.unlinkSync(getChatProviderSecretPath());
   } catch (err) {
     if (!isMissingFileError(err)) {
-      logger$v.warn("Could not delete provider secret file:", err);
+      logger$x.warn("Could not delete provider secret file:", err);
     }
   }
 }
@@ -203,7 +203,7 @@ function readStoredCodexTokens() {
     }
   } catch (err) {
     if (!isMissingFileError(err)) {
-      logger$v.warn("Could not read stored Codex tokens:", err);
+      logger$x.warn("Could not read stored Codex tokens:", err);
     }
   }
   return null;
@@ -221,7 +221,7 @@ function clearStoredCodexTokens() {
     fs.unlinkSync(getCodexTokensPath());
   } catch (err) {
     if (!isMissingFileError(err)) {
-      logger$v.warn("Could not delete Codex token file:", err);
+      logger$x.warn("Could not delete Codex token file:", err);
     }
   }
 }
@@ -351,7 +351,9 @@ function persistNow() {
       JSON.stringify(buildPersistedSettings(settings), null, 2),
       { encoding: "utf-8", mode: 384 }
     )
-  ).then(() => fs.promises.chmod(getSettingsPath(), 384).catch(() => void 0)).catch((err) => logger$v.error("Failed to save settings:", err));
+  ).then(() => fs.promises.chmod(getSettingsPath(), 384).catch((err) => {
+    logger$x.warn("Failed to chmod settings file:", err);
+  })).catch((err) => logger$x.error("Failed to save settings:", err));
 }
 function saveSettings() {
   saveDirty = true;
@@ -530,7 +532,7 @@ const urlSafety = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePro
 }, Symbol.toStringTag, { value: "Module" }));
 const MAX_CUSTOM_HISTORY = 50;
 const READER_MODE_DATA_URL_PREFIX = "data:text/html;charset=utf-8,";
-const logger$u = createLogger("Tab");
+const logger$w = createLogger("Tab");
 const sessionCertExceptions = /* @__PURE__ */ new WeakMap();
 const sessionsWithVerifyProc = /* @__PURE__ */ new WeakSet();
 const CERT_VERIFY_TRUST = 0;
@@ -596,7 +598,7 @@ class Tab {
   guardedLoadURL(url, options) {
     const blockReason = this.getNavigationBlockReason(url);
     if (blockReason) {
-      logger$u.warn(blockReason);
+      logger$w.warn(blockReason);
       return blockReason;
     }
     void this.view.webContents.loadURL(url, options);
@@ -680,7 +682,7 @@ class Tab {
     wc.setWindowOpenHandler(({ url, disposition }) => {
       const error = this.getNavigationBlockReason(url);
       if (error) {
-        logger$u.warn(error);
+        logger$w.warn(error);
         return { action: "deny" };
       }
       this.onOpenUrl?.({
@@ -694,7 +696,7 @@ class Tab {
       const error = this.getNavigationBlockReason(url);
       if (!error) return;
       event.preventDefault();
-      logger$u.warn(`${context}: ${error}`);
+      logger$w.warn(`${context}: ${error}`);
     };
     wc.on("will-navigate", (event, url) => {
       blockNavigation(event, url, "Blocked top-level navigation");
@@ -778,7 +780,7 @@ class Tab {
         ::-webkit-scrollbar-thumb { background: rgba(255,255,255,0.12); border-radius: 999px; }
         ::-webkit-scrollbar-thumb:hover { background: rgba(255,255,255,0.22); }
         ::-webkit-scrollbar-corner { background: transparent; }
-      `).catch((err) => logger$u.warn("Failed to inject scrollbar CSS:", err));
+      `).catch((err) => logger$w.warn("Failed to inject scrollbar CSS:", err));
     });
     wc.on("page-favicon-updated", (_, favicons) => {
       this._state.favicon = favicons[0] || "";
@@ -814,7 +816,7 @@ class Tab {
       ).then((highlightedText) => {
         this.buildContextMenu(wc, params, highlightedText.trim());
       }).catch((err) => {
-        logger$u.warn("Failed to inspect highlighted text for context menu:", err);
+        logger$w.warn("Failed to inspect highlighted text for context menu:", err);
         this.buildContextMenu(wc, params, "");
       });
     });
@@ -1015,7 +1017,7 @@ class Tab {
         "document.documentElement.outerHTML"
       );
     } catch (err) {
-      logger$u.warn("Failed to retrieve page source:", err);
+      logger$w.warn("Failed to retrieve page source:", err);
       return;
     }
     const escaped = html.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -1135,7 +1137,9 @@ class Tab {
                     range.insertNode(mark);
                   }
                 }
-              } catch(e) {}
+              } catch {
+                // Swallow — complex cross-node selections may fail to wrap
+              }
               sel.removeAllRanges();
               // Notify main process for persistence
               window.__vessel.notifyHighlightSelection(text);
@@ -1143,7 +1147,7 @@ class Tab {
             document.addEventListener('mouseup', window.__vesselHighlightHandler);
           }
         })()
-      `).catch((err) => logger$u.warn("Failed to inject highlight listener:", err));
+      `).catch((err) => logger$w.warn("Failed to inject highlight listener:", err));
     } else {
       void wc.executeJavaScript(`
         (function() {
@@ -1154,7 +1158,7 @@ class Tab {
             delete window.__vesselHighlightHandler;
           }
         })()
-      `).catch((err) => logger$u.warn("Failed to remove highlight listener:", err));
+      `).catch((err) => logger$w.warn("Failed to remove highlight listener:", err));
     }
   }
   get webContentsId() {
@@ -1191,7 +1195,7 @@ const SEARCH_ENGINE_PRESETS = {
   ecosia: { label: "Ecosia", url: "https://www.ecosia.org/search?q=" },
   kagi: { label: "Kagi", url: "https://kagi.com/search?q=" }
 };
-const logger$t = createLogger("JsonPersistence");
+const logger$v = createLogger("JsonPersistence");
 function canUseSafeStorage() {
   try {
     return electron.safeStorage.isEncryptionAvailable();
@@ -1256,7 +1260,9 @@ function createDebouncedJsonPersistence({
         data,
         typeof data === "string" ? { encoding: "utf-8", mode: 384 } : { mode: 384 }
       )
-    ).then(() => fs.promises.chmod(filePath2, 384).catch(() => void 0)).catch((err) => logger$t.error(`Failed to save ${logLabel}:`, err));
+    ).then(() => fs.promises.chmod(filePath2, 384).catch((err) => {
+      logger$v.warn(`Failed to chmod ${logLabel}:`, err);
+    })).catch((err) => logger$v.error(`Failed to save ${logLabel}:`, err));
   };
   const schedule = () => {
     saveDirty2 = true;
@@ -1529,7 +1535,7 @@ function applyTextRangeMatch(match, solidColor, bgColor, fullText) {
     try {
       var mark = markTextSegment(segments[i], solidColor, bgColor, fullText);
       if (mark) marks.unshift(mark);
-    } catch (_e) {}
+    } catch (_e) { /* text segment couldn't be marked — it may overlap other highlights */ }
   }
   return marks;
 }
@@ -1869,7 +1875,7 @@ async function highlightBatchOnPage(wc, entries) {
               el.style.setProperty('outline-color', c.solid, 'important');
               el.style.setProperty('box-shadow', '0 0 8px ' + c.glow, 'important');
             }
-          } catch (_e) {}
+          } catch (_e) { /* selector may not exist on current page */ }
         }
       }
     })()
@@ -2948,7 +2954,7 @@ function destroySession(tabId) {
     sessions.delete(tabId);
   }
 }
-const logger$s = createLogger("TabManager");
+const logger$u = createLogger("TabManager");
 function sanitizeFilename(title, ext) {
   const clean = title.replace(/[<>:"/\\|?*\x00-\x1f]/g, " ").replace(/\s+/g, " ").trim();
   const escapedExt = ext.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -3367,7 +3373,7 @@ class TabManager {
     }));
     if (entries.length > 0) {
       void highlightBatchOnPage(wc, entries).catch(
-        (err) => logger$s.warn("Failed to batch highlight:", err)
+        (err) => logger$u.warn("Failed to batch highlight:", err)
       );
     }
   }
@@ -3389,12 +3395,12 @@ class TabManager {
         const result = await captureSelectionHighlight(wc);
         if (result.success && result.text) {
           await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(
-            (err) => logger$s.warn("Failed to capture highlight:", err)
+            (err) => logger$u.warn("Failed to capture highlight:", err)
           );
         }
         this.highlightCaptureCallback?.(result);
       } catch (err) {
-        logger$s.warn("Failed to capture highlight from page:", err);
+        logger$u.warn("Failed to capture highlight from page:", err);
         this.highlightCaptureCallback?.({
           success: false,
           message: "Could not capture selection"
@@ -3419,7 +3425,7 @@ class TabManager {
           void this.removeHighlightMarksForText(wc, text);
         }
       } catch (err) {
-        logger$s.warn("Failed to remove highlight from matching tab:", err);
+        logger$u.warn("Failed to remove highlight from matching tab:", err);
       }
     }
     this.highlightCaptureCallback?.({
@@ -3450,12 +3456,12 @@ class TabManager {
               void 0,
               color
             ).catch(
-              (err) => logger$s.warn("Failed to update highlight color:", err)
+              (err) => logger$u.warn("Failed to update highlight color:", err)
             );
           });
         }
       } catch (err) {
-        logger$s.warn("Failed to iterate highlights for color change:", err);
+        logger$u.warn("Failed to iterate highlights for color change:", err);
       }
     }
     this.highlightCaptureCallback?.({
@@ -3510,7 +3516,7 @@ class TabManager {
         });
       })()`
     ).catch(
-      (err) => logger$s.warn("Failed to remove highlight marks:", err)
+      (err) => logger$u.warn("Failed to remove highlight marks:", err)
     );
   }
   broadcastState(meta = { persistSession: false }) {
@@ -3532,9 +3538,6 @@ const AIChannels = {
   AI_STREAM_END: "ai:stream-end",
   AI_STREAM_IDLE: "ai:stream-idle",
   AI_RESEARCH_CLARIFICATION: "ai:research-clarification",
-  AUTOMATION_ACTIVITY_START: "automation:activity-start",
-  AUTOMATION_ACTIVITY_CHUNK: "automation:activity-chunk",
-  AUTOMATION_ACTIVITY_END: "automation:activity-end",
   AI_CANCEL: "ai:cancel",
   AI_FETCH_MODELS: "ai:fetch-models",
   AGENT_RUNTIME_GET: "agent-runtime:get",
@@ -3561,6 +3564,9 @@ const AutomationChannels = {
   AUTOMATION_GET_INSTALLED: "automation:get-installed",
   AUTOMATION_INSTALL_FROM_FILE: "automation:install-from-file",
   AUTOMATION_UNINSTALL: "automation:uninstall",
+  AUTOMATION_ACTIVITY_START: "automation:activity-start",
+  AUTOMATION_ACTIVITY_CHUNK: "automation:activity-chunk",
+  AUTOMATION_ACTIVITY_END: "automation:activity-end",
   SCHEDULE_GET_ALL: "schedule:get-all",
   SCHEDULE_CREATE: "schedule:create",
   SCHEDULE_UPDATE: "schedule:update",
@@ -3646,6 +3652,9 @@ const HumanVaultChannels = {
   HUMAN_VAULT_REMOVE: "human-vault:remove",
   HUMAN_VAULT_AUDIT_LOG: "human-vault:audit-log"
 };
+const McpChannels = {
+  MCP_REGENERATE_TOKEN: "mcp:regenerate-token"
+};
 const OpenRouterChannels = {
   OPENROUTER_START_AUTH: "openrouter:start-auth",
   OPENROUTER_CANCEL_AUTH: "openrouter:cancel-auth",
@@ -3695,8 +3704,9 @@ const SettingsChannels = {
   SETTINGS_SET: "settings:set",
   SETTINGS_UPDATE: "settings:update",
   SETTINGS_HEALTH_GET: "settings:health:get",
-  SETTINGS_HEALTH_UPDATE: "settings:health:update",
-  MCP_REGENERATE_TOKEN: "mcp:regenerate-token",
+  SETTINGS_HEALTH_UPDATE: "settings:health:update"
+};
+const SupportChannels = {
   SUPPORT_SUBMIT_FEEDBACK: "support:submit-feedback"
 };
 const TabChannels = {
@@ -3728,14 +3738,7 @@ const TabChannels = {
   TAB_TOGGLE_MUTE: "tab:toggle-mute",
   TAB_PRINT: "tab:print",
   TAB_PRINT_TO_PDF: "tab:print-to-pdf",
-  TAB_TOGGLE_PIP: "tab:toggle-pip",
-  OPEN_NEW_WINDOW: "window:open-new",
-  OPEN_PRIVATE_WINDOW: "private:open-window",
-  IS_PRIVATE_MODE: "private:is-private",
-  FIND_IN_PAGE_START: "find:start",
-  FIND_IN_PAGE_NEXT: "find:next",
-  FIND_IN_PAGE_STOP: "find:stop",
-  FIND_IN_PAGE_RESULT: "find:result"
+  TAB_TOGGLE_PIP: "tab:toggle-pip"
 };
 const UIChannels = {
   SIDEBAR_TOGGLE: "ui:sidebar-toggle",
@@ -3764,7 +3767,14 @@ const VaultChannels = {
 const WindowControlChannels = {
   WINDOW_MINIMIZE: "window:minimize",
   WINDOW_MAXIMIZE: "window:maximize",
-  WINDOW_CLOSE: "window:close"
+  WINDOW_CLOSE: "window:close",
+  OPEN_NEW_WINDOW: "window:open-new",
+  OPEN_PRIVATE_WINDOW: "private:open-window",
+  IS_PRIVATE_MODE: "private:is-private",
+  FIND_IN_PAGE_START: "find:start",
+  FIND_IN_PAGE_NEXT: "find:next",
+  FIND_IN_PAGE_STOP: "find:stop",
+  FIND_IN_PAGE_RESULT: "find:result"
 };
 const Channels = {
   ...AIChannels,
@@ -3779,6 +3789,7 @@ const Channels = {
   ...HighlightChannels,
   ...HistoryChannels,
   ...HumanVaultChannels,
+  ...McpChannels,
   ...OpenRouterChannels,
   ...PermissionChannels,
   ...PremiumChannels,
@@ -3786,6 +3797,7 @@ const Channels = {
   ...SecurityChannels,
   ...SessionChannels,
   ...SettingsChannels,
+  ...SupportChannels,
   ...TabChannels,
   ...UIChannels,
   ...UpdateChannels,
@@ -4748,7 +4760,15 @@ function errorResult(error, value) {
 function getErrorMessage(error, fallback = "Unknown error") {
   return error instanceof Error && error.message ? error.message : fallback;
 }
-const logger$r = createLogger("Premium");
+async function readJsonResponse(response, fallback, onError) {
+  try {
+    return await response.json();
+  } catch (err) {
+    onError(getErrorMessage(err, "JSON parse failed"));
+    return fallback;
+  }
+}
+const logger$t = createLogger("Premium");
 const VERIFICATION_API = process.env.VESSEL_PREMIUM_API || "https://vesselpremium.quantaintellect.com";
 const FREE_TOOL_ITERATION_LIMIT = 50;
 const REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -4924,7 +4944,7 @@ async function verifySubscription$1(identifier) {
     });
     if (!res.ok) {
       const detail = await readApiErrorDetail(res);
-      logger$r.warn(
+      logger$t.warn(
         "Verification API returned a non-OK status:",
         res.status,
         detail
@@ -4943,7 +4963,7 @@ async function verifySubscription$1(identifier) {
     setSetting("premium", updated);
     return updated;
   } catch (err) {
-    logger$r.warn("Verification failed:", err);
+    logger$t.warn("Verification failed:", err);
     return current;
   }
 }
@@ -4961,7 +4981,11 @@ async function requestActivationCode(email) {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ email: normalizedEmail })
     });
-    const data = await res.json().catch(() => ({}));
+    const data = await readJsonResponse(
+      res,
+      {},
+      (msg) => logger$t.warn("Failed to parse premium activation response:", msg)
+    );
     if (!res.ok || !data.challengeToken) {
       return errorResult(data.error || `HTTP ${res.status}`);
     }
@@ -5002,7 +5026,11 @@ async function verifyActivationCode(email, code, challengeToken) {
         challengeToken: challengeToken.trim()
       })
     });
-    const data = await res.json().catch(() => ({}));
+    const data = await readJsonResponse(
+      res,
+      {},
+      (msg) => logger$t.warn("Failed to parse premium verification response:", msg)
+    );
     if (!res.ok) {
       return errorResult(data.error || `HTTP ${res.status}`, {
         state: getPremiumState()
@@ -5598,7 +5626,7 @@ const EXTRACT_TIMEOUT_MAX_MS = 2e4;
 const MUTATION_CAPTURE_INTERVAL_MS = 5e3;
 const MUTATION_SETTLE_AFTER_MS = 1500;
 const AGENT_STREAM_IDLE_TIMEOUT_MS = 3e4;
-const logger$q = createLogger("Extractor");
+const logger$s = createLogger("Extractor");
 const EXTRACTION_CACHE_TTL_MS = 1500;
 const MAX_EXTRACTION_CACHE_ENTRIES = 50;
 const extractionCache = new BoundedCache(
@@ -5645,6 +5673,7 @@ const PRELOAD_EXTRACTION_SCRIPT = String.raw`
         }
       }
     } catch (_error) {
+      // Structured extraction unavailable, fall through to direct extraction
     }
     return null;
   })()
@@ -6284,9 +6313,9 @@ const DIRECT_EXTRACTION_SCRIPT = String.raw`
           } else if (parsed && typeof parsed === "object") {
             jsonLd.push(parsed);
           }
-        } catch (_e) {}
+        } catch (_e) { /* skip malformed JSON-LD block */ }
       });
-    } catch (_e) {}
+    } catch (_e) { /* no JSON-LD scripts found or querySelectorAll failed */ }
 
     // Extract meta tags as fallback
     var metaTags = {};
@@ -6299,8 +6328,7 @@ const DIRECT_EXTRACTION_SCRIPT = String.raw`
       });
       var canonical = document.querySelector('link[rel="canonical"]');
       if (canonical && canonical.getAttribute("href")) metaTags["canonical"] = canonical.getAttribute("href");
-    } catch (_e) {}
-
+    } catch (_e) { /* meta tag extraction failed — non-critical */ }
     return {
       title: document.title,
       content: getCleanBodyText(),
@@ -6363,9 +6391,9 @@ async function executeScript(webContents, script, options = {}) {
     const message = err instanceof Error ? err.message : String(err);
     const detail = `Failed to execute page script${label} on ${url}: ${message}`;
     if (options.warnOnFailure) {
-      logger$q.warn(detail);
+      logger$s.warn(detail);
     } else {
-      logger$q.debug(detail);
+      logger$s.debug(detail);
     }
     return null;
   } finally {
@@ -6474,7 +6502,7 @@ async function estimateExtractionTimeout(webContents) {
       return EXTRACT_TIMEOUT_BASE_MS + extra;
     }
   } catch (err) {
-    logger$q.warn("Failed to estimate extraction timeout, using base timeout:", err);
+    logger$s.warn("Failed to estimate extraction timeout, using base timeout:", err);
   }
   return EXTRACT_TIMEOUT_BASE_MS;
 }
@@ -7442,7 +7470,7 @@ function isClickReadLoop(names) {
   return clickReadPairs >= 2;
 }
 const TERMINAL_TOOL_RESULT = "__VESSEL_TERMINAL_TOOL_RESULT__";
-const logger$p = createLogger("PromptCache");
+const logger$r = createLogger("PromptCache");
 function shortHash(value) {
   return crypto$2.createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
@@ -7494,7 +7522,7 @@ function logOpenAIPromptCacheUsage(usage, context) {
   const details = record.prompt_tokens_details;
   const cachedTokens = details && typeof details === "object" ? numericField(details, "cached_tokens") : null;
   if (promptTokens === null && cachedTokens === null) return;
-  logger$p.debug("OpenAI prompt cache usage", {
+  logger$r.debug("OpenAI prompt cache usage", {
     model: context.model,
     mode: context.mode,
     promptTokens,
@@ -7510,7 +7538,7 @@ function logAnthropicPromptCacheUsage(usage, context) {
   if (inputTokens === null && cacheCreationTokens === null && cacheReadTokens === null) {
     return;
   }
-  logger$p.debug("Anthropic prompt cache usage", {
+  logger$r.debug("Anthropic prompt cache usage", {
     model: context.model,
     mode: context.mode,
     inputTokens,
@@ -8403,7 +8431,7 @@ function recoverNarratedActionToolCalls(text, availableToolNames) {
   }
   return recovered;
 }
-const logger$o = createLogger("OpenAIProvider");
+const logger$q = createLogger("OpenAIProvider");
 function shouldDebugAgentLoop() {
   const value = process.env.VESSEL_DEBUG_AGENT_LOOP;
   return value === "1" || value === "true";
@@ -8671,9 +8699,9 @@ function shouldRetryCompactToolLoop(profile, text, hasToolHistory, userMessage)
 function logAgentLoopDebug(payload) {
   if (!shouldDebugAgentLoop()) return;
   try {
-    logger$o.info(`[agent-debug] ${JSON.stringify(payload)}`);
+    logger$q.info(`[agent-debug] ${JSON.stringify(payload)}`);
   } catch (err) {
-    logger$o.warn("Failed to serialize debug payload:", err);
+    logger$q.warn("Failed to serialize debug payload:", err);
   }
 }
 function formatOpenAICompatErrorMessage(providerId, message) {
@@ -9113,6 +9141,9 @@ class OpenAICompatProvider {
     this.abortController?.abort();
   }
 }
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 async function openExternalAllowlisted(url, rule) {
   const parsed = new URL(url);
   const schemes = rule.schemes ?? ["https:"];
@@ -9297,7 +9328,7 @@ function createLocalPkceOAuthFlow(config) {
     isInProgress: () => activeFlow !== null
   };
 }
-const logger$n = createLogger("CodexOAuth");
+const logger$p = createLogger("CodexOAuth");
 const ISSUER = "https://auth.openai.com";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
@@ -9423,12 +9454,9 @@ async function refreshAccessToken(tokens) {
   };
   return refreshedTokens;
 }
-function escapeHtml$1(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
 const codexOAuth = createLocalPkceOAuthFlow({
   name: "Codex",
-  logger: logger$n,
+  logger: logger$p,
   preferredPorts: [PREFERRED_PORT$1, FALLBACK_PORT$1],
   timeoutMs: AUTH_TIMEOUT_MS$1,
   callbackPath: () => "/auth/callback",
@@ -9437,7 +9465,7 @@ const codexOAuth = createLocalPkceOAuthFlow({
   buildAuthorizeUrl: ({ callbackUrl, pkce, state: state2 }) => buildAuthorizeUrl(callbackUrl, pkce, state2),
   exchangeCode: ({ code, callbackUrl, codeVerifier }) => exchangeCodeForTokens(code, callbackUrl, codeVerifier),
   successHtml: (tokens) => {
-    const label = escapeHtml$1(tokens.accountEmail || tokens.accountId);
+    const label = escapeHtml(tokens.accountEmail || tokens.accountId);
     return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><title>Vessel — Signed In</title>
 <style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#111;color:#eee}</style></head>
@@ -9452,7 +9480,7 @@ async function startCodexOAuth(onStatus) {
 function cancelCodexOAuth() {
   codexOAuth.cancel();
 }
-const logger$m = createLogger("CodexProvider");
+const logger$o = createLogger("CodexProvider");
 const REFRESH_WINDOW_MS = 5 * 60 * 1e3;
 const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
 const CODEX_CLIENT_VERSION = "0.129.0";
@@ -9517,7 +9545,7 @@ class CodexProvider {
   async ensureFreshTokens() {
     if (Date.now() < this.tokens.expiresAt - REFRESH_WINDOW_MS) return;
     try {
-      logger$m.info("Refreshing Codex access token");
+      logger$o.info("Refreshing Codex access token");
       const fresh = await refreshAccessToken(this.tokens);
       this.tokens = fresh;
       writeStoredCodexTokens(fresh);
@@ -9665,7 +9693,7 @@ class CodexProvider {
     } catch (err) {
       if (err.name !== "AbortError") {
         const msg = err instanceof Error ? err.message : String(err);
-        logger$m.error("Codex streamQuery error:", err);
+        logger$o.error("Codex streamQuery error:", err);
         onChunk(`
 
 [Error: ${msg}]`);
@@ -9733,7 +9761,7 @@ class CodexProvider {
     } catch (err) {
       if (err.name !== "AbortError") {
         const msg = err instanceof Error ? err.message : String(err);
-        logger$m.error("Codex streamAgentQuery error:", err);
+        logger$o.error("Codex streamAgentQuery error:", err);
         onChunk(`
 
 [Error: ${msg}]`);
@@ -10967,7 +10995,7 @@ function normalizeBookmarkMetadataUpdate(input) {
   }
   return normalized;
 }
-const logger$l = createLogger("BookmarkManager");
+const logger$n = createLogger("BookmarkManager");
 const UNSORTED_ID = "unsorted";
 const ARCHIVE_FOLDER_NAME = "Archive";
 const NETSCAPE_BOOKMARKS_DOCTYPE = "<!DOCTYPE NETSCAPE-Bookmark-file-1>";
@@ -11540,7 +11568,7 @@ function importBookmarksFromJson(content) {
       emit$2();
     }
   } catch (err) {
-    logger$l.warn("Failed to import bookmarks from JSON:", err);
+    logger$n.warn("Failed to import bookmarks from JSON:", err);
     errors++;
   }
   return { imported, skipped, errors };
@@ -11945,6 +11973,7 @@ async function resolveSelector(wc, index, selector) {
   if (extractedSelector) return extractedSelector;
   return null;
 }
+const logger$m = createLogger("LinkValidation");
 const DEAD_STATUS_CODES = /* @__PURE__ */ new Set([404, 410, 451]);
 const HEAD_FALLBACK_STATUS_CODES = /* @__PURE__ */ new Set([400, 403, 404, 405, 406, 500, 501]);
 function isHttpUrl(value) {
@@ -11967,7 +11996,9 @@ async function requestUrl(url, method, timeoutMs) {
         "user-agent": "Vessel/0.1.0 (+https://github.com/unmodeled-tyler/vessel-browser)"
       }
     });
-    await response.body?.cancel().catch(() => void 0);
+    await response.body?.cancel().catch((err) => {
+      logger$m.debug("Failed to cancel response body:", err);
+    });
     return response;
   } finally {
     clearTimeout(timer);
@@ -12030,7 +12061,7 @@ function formatDeadLinkMessage(label, result) {
   const status = result.statusCode ? `HTTP ${result.statusCode}` : "dead link";
   return `Skipped stale link "${label}" because ${destination} returned ${status}. Try a different link or URL instead.`;
 }
-const logger$k = createLogger("Screenshot");
+const logger$l = createLogger("Screenshot");
 const SCREENSHOT_RETRY_COUNT = 3;
 const SCREENSHOT_RETRY_BASE_DELAY_MS = 120;
 async function captureScreenshot(wc) {
@@ -12052,7 +12083,7 @@ async function captureScreenshot(wc) {
         }
       }
     } catch (err) {
-      logger$k.debug(
+      logger$l.debug(
         `capturePage attempt ${attempt + 1} failed; retrying if attempts remain.`,
         getErrorMessage(err)
       );
@@ -14529,7 +14560,7 @@ class TabMutex {
     return run;
   }
 }
-const logger$j = createLogger("PageActions");
+const logger$k = createLogger("PageActions");
 const DEFAULT_PAGE_SCRIPT_TIMEOUT_MS = 1500;
 const PAGE_SCRIPT_TIMEOUT = /* @__PURE__ */ Symbol("page-script-timeout");
 function pageBusyError(action) {
@@ -14557,7 +14588,7 @@ async function executePageScript(wc, script, options) {
     return result;
   } catch (err) {
     const label = options?.label ? ` (${options.label})` : "";
-    logger$j.warn(`Failed to execute page script${label}:`, err);
+    logger$k.warn(`Failed to execute page script${label}:`, err);
     return null;
   } finally {
     if (timer) {
@@ -14754,7 +14785,9 @@ Page title: ${title}` : "";
             signals.push('consent-banner:' + consentSelectors[i]);
             break;
           }
-        } catch(e) {}
+        } catch {
+          // Swallow — cross-origin frames may block selector access
+        }
       }
       var vw = window.innerWidth || 0;
       var vh = window.innerHeight || 0;
@@ -14797,7 +14830,7 @@ Search results snapshot:
 ${truncated}`;
     }
   } catch (err) {
-    logger$j.warn("Failed to build post-search summary, falling back to nav summary:", err);
+    logger$k.warn("Failed to build post-search summary, falling back to nav summary:", err);
   }
   const fallback = await getPostNavSummary(wc);
   return fallback ? `${fallback}
@@ -14820,7 +14853,7 @@ Page snapshot after navigation:
 ${truncated}`;
     }
   } catch (err) {
-    logger$j.warn("Failed to build post-click navigation summary:", err);
+    logger$k.warn("Failed to build post-click navigation summary:", err);
   }
   return "";
 }
@@ -15710,7 +15743,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       }
     }
   } catch (err) {
-    logger$j.warn("Failed to restore locale via history navigation, trying URL reload fallback:", err);
+    logger$k.warn("Failed to restore locale via history navigation, trying URL reload fallback:", err);
   }
   if (snapshot2.url && snapshot2.url !== wc.getURL()) {
     try {
@@ -15719,7 +15752,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       await waitForLoad(wc, 3e3);
       return;
     } catch (err) {
-      logger$j.warn("Failed to restore locale via safe URL load, trying page reload fallback:", err);
+      logger$k.warn("Failed to restore locale via safe URL load, trying page reload fallback:", err);
     }
   }
   if (snapshot2.url) {
@@ -15727,7 +15760,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       await wc.reload();
       await waitForLoad(wc, 3e3);
     } catch (err) {
-      logger$j.warn("Failed to restore locale via page reload:", err);
+      logger$k.warn("Failed to restore locale via page reload:", err);
     }
   }
 }
@@ -15792,7 +15825,7 @@ async function followHrefFromClickResult(wc, beforeUrl, result, logMessage) {
     const hrefUrl = wc.getURL();
     if (hrefUrl !== beforeUrl) return `${result.split("\n")[0]} -> ${hrefUrl}`;
   } catch (err) {
-    logger$j.warn(logMessage, err);
+    logger$k.warn(logMessage, err);
   }
   return null;
 }
@@ -16004,7 +16037,7 @@ ${postActivationOverlayHint}`;
           return `${clickText} -> ${hrefFallbackUrl} (recovered via href fallback)`;
         }
       } catch (err) {
-        logger$j.warn("Failed href fallback after click, returning generic click result:", err);
+        logger$k.warn("Failed href fallback after click, returning generic click result:", err);
       }
     }
   }
@@ -16049,7 +16082,7 @@ async function tryAutoDismissCartDialog(wc) {
       return result;
     }
   } catch (err) {
-    logger$j.warn("Failed to auto-dismiss cart dialog, falling back to dialog actions:", err);
+    logger$k.warn("Failed to auto-dismiss cart dialog, falling back to dialog actions:", err);
   }
   return null;
 }
@@ -16502,7 +16535,9 @@ async function tryDismissConsentIframe(wc) {
                     return 'Clicked iframe consent button: ' + text.slice(0, 60);
                   }
                 }
-              } catch(e) {}
+              } catch {
+                // Swallow — selector may be invalid or cross-origin frame may block access
+              }
             }
             // Text-match fallback on all buttons
             var buttons = document.querySelectorAll('button, [role="button"], a.message-component');
@@ -17809,60 +17844,7 @@ WARNING: This page shows no results. You likely clicked a filter or category lin
   }
   return "";
 }
-const KNOWN_TOOLS = /* @__PURE__ */ new Set([
-  "current_tab",
-  "list_tabs",
-  "switch_tab",
-  "create_tab",
-  "navigate",
-  "go_back",
-  "go_forward",
-  "reload",
-  "click",
-  "inspect_element",
-  "type_text",
-  "select_option",
-  "submit_form",
-  "press_key",
-  "scroll",
-  "hover",
-  "focus",
-  "set_ad_blocking",
-  "dismiss_popup",
-  "clear_overlays",
-  "read_page",
-  "screenshot",
-  "wait_for",
-  "create_checkpoint",
-  "restore_checkpoint",
-  "save_session",
-  "load_session",
-  "list_sessions",
-  "delete_session",
-  "list_bookmarks",
-  "search_bookmarks",
-  "create_bookmark_folder",
-  "save_bookmark",
-  "organize_bookmark",
-  "archive_bookmark",
-  "open_bookmark",
-  "highlight",
-  "clear_highlights",
-  "flow_start",
-  "flow_advance",
-  "flow_status",
-  "flow_end",
-  "suggest",
-  "fill_form",
-  "login",
-  "search",
-  "paginate",
-  "accept_cookies",
-  "extract_table",
-  "scroll_to_element",
-  "metrics",
-  "wait_for_navigation"
-]);
+const KNOWN_TOOLS = new Set(TOOL_DEFINITIONS.map((d) => d.name));
 async function executeAction(name, args, ctx) {
   name = normalizeToolAlias(name);
   if (ctx.tabId && ctx._tabMutex) {
@@ -18204,7 +18186,7 @@ async function executeAction(name, args, ctx) {
               )
             ]);
           } catch (err) {
-            logger$j.warn("Failed to extract content for read_page, falling back to lighter recovery:", err);
+            logger$k.warn("Failed to extract content for read_page, falling back to lighter recovery:", err);
             content = null;
           }
           if (!content || content.content.length === 0) {
@@ -18221,12 +18203,12 @@ async function executeAction(name, args, ctx) {
                     new Promise((resolve) => setTimeout(() => resolve(null), 3e3))
                   ]);
                 } catch (err) {
-                  logger$j.warn("Failed to re-extract content after iframe consent dismissal:", err);
+                  logger$k.warn("Failed to re-extract content after iframe consent dismissal:", err);
                   content = null;
                 }
               }
             } catch (err) {
-              logger$j.warn("Failed iframe consent dismissal during read_page recovery:", err);
+              logger$k.warn("Failed iframe consent dismissal during read_page recovery:", err);
             }
           }
           if (content && content.content.length > 0) {
@@ -18639,7 +18621,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
           try {
             page = await extractContent(wc);
           } catch (err) {
-            logger$j.warn("Failed to extract content for suggest:", err);
+            logger$k.warn("Failed to extract content for suggest:", err);
             return "Could not read page. Try navigate to a working URL.";
           }
           const suggestions = [];
@@ -19027,7 +19009,7 @@ WARNING: You have clicked ${clickStreakCount} elements on this page without veri
   }
   return formattedResult + await getPostActionState$1(ctx, name) + clickNavSummary + streakWarning + flowCtx;
 }
-const logger$i = createLogger("ResearchOrchestrator");
+const logger$j = createLogger("ResearchOrchestrator");
 const MAX_THREADS = 5;
 const MAX_TRACE_ARGS_CHARS = 1200;
 const MAX_TRACE_RESULT_CHARS = 2e3;
@@ -19216,7 +19198,7 @@ class ResearchOrchestrator {
   }
   stopAndSynthesizeCurrentFindings() {
     if (this.state.phase !== "executing") {
-      logger$i.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
+      logger$j.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
       return;
     }
     this.stopRequested = true;
@@ -19250,23 +19232,23 @@ class ResearchOrchestrator {
   async startBrief(userQuery) {
     const query = userQuery.trim();
     if (!query) {
-      logger$i.warn("Ignoring empty Research Desk query");
+      logger$j.warn("Ignoring empty Research Desk query");
       return;
     }
     if (this.state.phase !== "idle") {
-      logger$i.warn("Research already in progress, ignoring startBrief");
+      logger$j.warn("Research already in progress, ignoring startBrief");
       return;
     }
     this.state = this.initialState();
     this.state.originalQuery = query;
     this.state.startedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.setPhase("briefing");
-    logger$i.info(`Brief started for query: ${query.slice(0, 120)}`);
+    logger$j.info(`Brief started for query: ${query.slice(0, 120)}`);
   }
   // ── phase: briefing → planning ─────────────────────────────────
   confirmBrief() {
     if (this.state.phase !== "briefing") {
-      logger$i.warn("Not in briefing phase, ignoring confirmBrief");
+      logger$j.warn("Not in briefing phase, ignoring confirmBrief");
       return;
     }
     this.setPhase("planning");
@@ -19274,7 +19256,7 @@ class ResearchOrchestrator {
   // ── phase: planning → awaiting_approval ────────────────────────
   setObjectives(objectives) {
     if (this.state.phase !== "planning") {
-      logger$i.warn("Not in planning phase, ignoring setObjectives");
+      logger$j.warn("Not in planning phase, ignoring setObjectives");
       return;
     }
     const threads = objectives.threads.slice(0, MAX_THREADS).map(mergeBlockedSourceDomains);
@@ -19303,11 +19285,11 @@ class ResearchOrchestrator {
     try {
       const parsed = JSON.parse(json);
       if (typeof parsed.researchQuestion !== "string" || !parsed.researchQuestion.trim()) {
-        logger$i.warn("Missing researchQuestion in objectives JSON");
+        logger$j.warn("Missing researchQuestion in objectives JSON");
         return false;
       }
       if (!Array.isArray(parsed.threads) || parsed.threads.length === 0) {
-        logger$i.warn("Missing or empty threads array in objectives JSON");
+        logger$j.warn("Missing or empty threads array in objectives JSON");
         return false;
       }
       const threads = parsed.threads.map((t, i) => {
@@ -19325,7 +19307,7 @@ class ResearchOrchestrator {
         };
       }).filter((thread) => thread.question && thread.searchQueries.length > 0).slice(0, MAX_THREADS);
       if (threads.length === 0) {
-        logger$i.warn("Objectives JSON did not contain any valid research threads");
+        logger$j.warn("Objectives JSON did not contain any valid research threads");
         return false;
       }
       const objectives = {
@@ -19336,17 +19318,17 @@ class ResearchOrchestrator {
         totalSourceBudget: threads.reduce((sum, t) => sum + t.sourceBudget, 0)
       };
       this.setObjectives(objectives);
-      logger$i.info(`Parsed ${objectives.threads.length} threads from objectives`);
+      logger$j.info(`Parsed ${objectives.threads.length} threads from objectives`);
       return true;
     } catch (err) {
-      logger$i.warn("Failed to parse objectives JSON", err);
+      logger$j.warn("Failed to parse objectives JSON", err);
       return false;
     }
   }
   // ── phase: awaiting_approval → executing ───────────────────────
   approveObjectives(mode, includeTraces) {
     if (this.state.phase !== "awaiting_approval") {
-      logger$i.warn("Not awaiting approval, ignoring approveObjectives");
+      logger$j.warn("Not awaiting approval, ignoring approveObjectives");
       return;
     }
     if (mode) this.state.supervisionMode = mode;
@@ -19381,7 +19363,7 @@ class ResearchOrchestrator {
       this.state.threads.map((thread) => {
         if (this.state.phase !== "executing") return null;
         return this.runSubAgent(thread, tabMutex).catch((err) => {
-          logger$i.error(`Sub-agent "${thread.label}" failed`, err);
+          logger$j.error(`Sub-agent "${thread.label}" failed`, err);
           return {
             threadLabel: thread.label,
             threadQuestion: thread.question,
@@ -19410,7 +19392,7 @@ class ResearchOrchestrator {
     try {
       await this.synthesizeReport();
     } catch (err) {
-      logger$i.error("Auto-synthesis failed", err);
+      logger$j.error("Auto-synthesis failed", err);
       this.state.error = `Synthesis failed: ${String(err)}`;
       this.setPhase("delivered");
     }
@@ -19521,7 +19503,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
         try {
           this.tabManager.closeTab(tabId);
         } catch (err) {
-          logger$i.warn(`Failed to close sub-agent tab ${tabId}`, err);
+          logger$j.warn(`Failed to close sub-agent tab ${tabId}`, err);
         }
       }
     }
@@ -19530,7 +19512,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
       try {
         claims = await this.extractClaimsFromTranscript(thread, transcript);
       } catch (err) {
-        logger$i.warn(`Claim extraction failed for "${thread.label}"`, err);
+        logger$j.warn(`Claim extraction failed for "${thread.label}"`, err);
       }
     }
     if (this.state.phase === "executing" && this.state.includeTraces) {
@@ -19620,7 +19602,7 @@ ${transcript.slice(0, 32e3)}`;
         (claim) => claim.claim && claim.sourceUrl && claim.extractedQuote
       );
     } catch {
-      logger$i.warn(`Failed to parse claims JSON for "${thread.label}"`);
+      logger$j.warn(`Failed to parse claims JSON for "${thread.label}"`);
       return [];
     }
   }
@@ -19705,7 +19687,7 @@ ${transcript.slice(0, 32e3)}`;
         objectives
       };
     } catch (err) {
-      logger$i.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
+      logger$j.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
       return buildFallbackReport(objectives, findings, String(err));
     }
   }
@@ -20252,7 +20234,7 @@ function loadRenderers(chromeView, sidebarView, devtoolsPanelView) {
     });
   }
 }
-const logger$h = createLogger("PrivateWindow");
+const logger$i = createLogger("PrivateWindow");
 const privateWindows = /* @__PURE__ */ new Set();
 function layoutPrivateViews(state2) {
   const { window: win, chromeView, tabManager } = state2;
@@ -20473,7 +20455,7 @@ function createPrivateWindow() {
       privateSession.clearStorageData(),
       privateSession.clearCache()
     ]).catch((error) => {
-      logger$h.warn("Failed to clear private browsing session:", error);
+      logger$i.warn("Failed to clear private browsing session:", error);
     });
   });
   privateWindows.add(state2);
@@ -20483,7 +20465,7 @@ function createPrivateWindow() {
   });
   loadPrivateRenderer(chromeView);
   win.show();
-  logger$h.info("Private browsing window opened");
+  logger$i.info("Private browsing window opened");
   return state2;
 }
 const window$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -20857,7 +20839,7 @@ function registerTabHandlers(windowState2, _sendToRendererViews) {
   });
 }
 const require$1 = node_module.createRequire(require("url").pathToFileURL(__filename).href);
-const logger$g = createLogger("DevTrace");
+const logger$h = createLogger("DevTrace");
 let cachedFactory;
 function createNoopTraceSession() {
   return {
@@ -20890,7 +20872,7 @@ function loadLocalFactory() {
         return cachedFactory;
       }
     } catch (err) {
-      logger$g.warn("Failed to load local trace logger:", err);
+      logger$h.warn("Failed to load local trace logger:", err);
     }
   }
   return cachedFactory;
@@ -21682,9 +21664,6 @@ function renderReaderContent(page) {
   }
   return source.split(/\n{2,}/).map((block) => block.trim()).filter(Boolean).map((block) => `<p>${escapeHtml(block).replace(/\n/g, "<br>")}</p>`).join("\n");
 }
-function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
 function registerContentHandlers(windowState2) {
   const { tabManager } = windowState2;
   electron.ipcMain.handle(Channels.CONTENT_EXTRACT, async (event) => {
@@ -21721,7 +21700,7 @@ function registerContentHandlers(windowState2) {
     return windowState2.uiState.focusMode;
   });
 }
-const logger$f = createLogger("HighlightIPC");
+const logger$g = createLogger("HighlightIPC");
 function registerHighlightHandlers(windowState2, sendToRendererViews) {
   const { tabManager, chromeView } = windowState2;
   const getActiveHighlightCountSafe = async () => {
@@ -21730,7 +21709,7 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
     try {
       return await getHighlightCount(info.wc) ?? 0;
     } catch (err) {
-      logger$f.warn("Failed to get active highlight count:", err);
+      logger$g.warn("Failed to get active highlight count:", err);
       return 0;
     }
   };
@@ -21755,13 +21734,13 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
       const result = await captureSelectionHighlight(wc);
       if (result.success && result.text) {
         await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(
-          (err) => logger$f.warn("Failed to highlight captured selection:", err)
+          (err) => logger$g.warn("Failed to highlight captured selection:", err)
         );
         await emitHighlightCount();
       }
       return result;
     } catch (err) {
-      logger$f.warn("Failed to capture highlight from active tab:", err);
+      logger$g.warn("Failed to capture highlight from active tab:", err);
       return { success: false, message: "Could not capture selection" };
     }
   });
@@ -21778,7 +21757,7 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
         }
       });
     } catch (err) {
-      logger$f.warn("Failed to persist auto-highlight selection:", err);
+      logger$g.warn("Failed to persist auto-highlight selection:", err);
     }
   });
   electron.ipcMain.handle(Channels.HIGHLIGHT_NAV_COUNT, (event) => {
@@ -21792,7 +21771,7 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
     try {
       return scrollToHighlight(info.wc, index);
     } catch (err) {
-      logger$f.warn("Failed to scroll to highlight:", err);
+      logger$g.warn("Failed to scroll to highlight:", err);
       return false;
     }
   });
@@ -21807,7 +21786,7 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
       }
       return removed;
     } catch (err) {
-      logger$f.warn("Failed to remove highlight at index:", err);
+      logger$g.warn("Failed to remove highlight at index:", err);
       return false;
     }
   });
@@ -21822,7 +21801,7 @@ function registerHighlightHandlers(windowState2, sendToRendererViews) {
       }
       return cleared;
     } catch (err) {
-      logger$f.warn("Failed to clear highlight elements:", err);
+      logger$g.warn("Failed to clear highlight elements:", err);
       return false;
     }
   });
@@ -22791,7 +22770,7 @@ Exception: ${result.exceptionDetails}`);
     }
   );
 }
-const logger$e = createLogger("MCP");
+const logger$f = createLogger("MCP");
 function asTextResponse(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -22892,7 +22871,7 @@ async function getPostActionState(tabManager, name) {
         }
       }
     } catch (err) {
-      logger$e.warn("Failed to compute post-action state warning:", err);
+      logger$f.warn("Failed to compute post-action state warning:", err);
     }
     return `${warning}
 [state: url=${wc.getURL()}, canGoBack=${tab.canGoBack()}, canGoForward=${tab.canGoForward()}, loading=${wc.isLoading()}]`;
@@ -22997,7 +22976,7 @@ async function waitForConditionMcp(wc, text, selector, timeoutMs) {
         }
       })()
     `).catch((err) => {
-      logger$e.warn("Failed to gather wait_for timeout diagnostic:", err);
+      logger$f.warn("Failed to gather wait_for timeout diagnostic:", err);
       return null;
     });
     if (typeof diagnostic === "string" && diagnostic.trim()) {
@@ -23483,6 +23462,7 @@ function registerBookmarkTools(server, tabManager, runtime2) {
             return `Opened bookmark "${bookmark.title}" in new tab ${createdId}`;
           }
           const activeId = tabManager.getActiveTabId();
+          if (!activeId) return "No active tab to open bookmark in";
           const activeTab = tabManager.getActiveTab();
           tabManager.navigateTab(activeId, bookmark.url);
           if (activeTab) {
@@ -23713,7 +23693,7 @@ function registerSessionTools(server, tabManager, runtime2) {
     )
   );
 }
-const logger$d = createLogger("VaultShared");
+const logger$e = createLogger("VaultShared");
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
@@ -23807,7 +23787,7 @@ function createVaultIO(vaultFilename, encrypt2, decrypt2) {
       cachedEntries = JSON.parse(json);
       return cachedEntries;
     } catch (err) {
-      logger$d.error("Failed to load vault:", err);
+      logger$e.error("Failed to load vault:", err);
       throw new Error("Could not unlock the vault. Check OS secret storage availability.");
     }
   }
@@ -23890,7 +23870,7 @@ function createAuditLog(filename, maxEntries) {
       } catch {
       }
     } catch (err) {
-      logger$d.error("Failed to write audit log:", err);
+      logger$e.error("Failed to write audit log:", err);
     }
   }
   function readAuditLog2(limit = 100) {
@@ -23900,7 +23880,7 @@ function createAuditLog(filename, maxEntries) {
       const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
       return lines.slice(-Math.min(limit, maxEntries)).map((line) => JSON.parse(line)).reverse();
     } catch (err) {
-      logger$d.error("Failed to read audit log:", err);
+      logger$e.error("Failed to read audit log:", err);
       return [];
     }
   }
@@ -23973,9 +23953,12 @@ async function requestConsent(request) {
   if (sessionTrustedDomains.has(domain)) {
     return { approved: true, trustForSession: true };
   }
-  const focusedWindow = electron.BrowserWindow.getFocusedWindow();
+  const parentWindow = electron.BrowserWindow.getFocusedWindow() ?? electron.BrowserWindow.getAllWindows()[0];
+  if (!parentWindow) {
+    return { approved: false, trustForSession: false };
+  }
   const { response } = await electron.dialog.showMessageBox(
-    focusedWindow ?? (electron.BrowserWindow.getAllWindows()[0] || null),
+    parentWindow,
     {
       type: "question",
       title: "Agent Credential Access",
@@ -24004,7 +23987,7 @@ async function requestConsent(request) {
 }
 const AUDIT_FILENAME = "vessel-vault-audit.jsonl";
 const MAX_ENTRIES = 1e3;
-const logger$c = createLogger("VaultAudit");
+const logger$d = createLogger("VaultAudit");
 function getAuditPath() {
   return path$1.join(electron.app.getPath("userData"), AUDIT_FILENAME);
 }
@@ -24018,7 +24001,7 @@ function appendAuditEntry(entry) {
     });
     fs$1.chmodSync(auditPath, 384);
   } catch (err) {
-    logger$c.error("Failed to write audit log:", err);
+    logger$d.error("Failed to write audit log:", err);
   }
 }
 function readAuditLog$1(limit = 100) {
@@ -24028,7 +24011,7 @@ function readAuditLog$1(limit = 100) {
     const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
     return lines.slice(-Math.min(limit, MAX_ENTRIES)).map((line) => JSON.parse(line)).reverse();
   } catch (err) {
-    logger$c.error("Failed to read audit log:", err);
+    logger$d.error("Failed to read audit log:", err);
     return [];
   }
 }
@@ -24198,7 +24181,7 @@ const mcpRuntimeState = {
   httpServer: null,
   authToken: null
 };
-const logger$b = createLogger("MCP");
+const logger$c = createLogger("MCP");
 const MCP_AUTH_FILENAME = "mcp-auth.json";
 function getMcpAuthFilePath() {
   const configDir = process.env.VESSEL_CONFIG_DIR || path$1.join(
@@ -24235,7 +24218,7 @@ function writeMcpAuthFile(endpoint, token) {
     );
     fs$1.chmodSync(filePath2, 384);
   } catch (err) {
-    logger$b.warn("Failed to write auth file:", err);
+    logger$c.warn("Failed to write auth file:", err);
   }
 }
 function clearMcpAuthFile() {
@@ -24261,7 +24244,7 @@ function clearMcpAuthFile() {
     );
     fs$1.chmodSync(filePath2, 384);
   } catch (err) {
-    logger$b.warn("Failed to clear auth file:", err);
+    logger$c.warn("Failed to clear auth file:", err);
   }
 }
 function regenerateMcpAuthToken() {
@@ -24271,7 +24254,7 @@ function regenerateMcpAuthToken() {
   writeMcpAuthFile(endpoint, mcpRuntimeState.authToken);
   return { endpoint };
 }
-const logger$a = createLogger("MCP");
+const logger$b = createLogger("MCP");
 function registerTools(server, tabManager, runtime2) {
   server.registerPrompt(
     "vessel-supervisor-brief",
@@ -24350,7 +24333,7 @@ function registerTools(server, tabManager, runtime2) {
           const page = await extractContent$1(wc);
           pageType = detectPageType(page);
         } catch (err) {
-          logger$a.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
+          logger$b.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
         }
       }
       const scored = TOOL_DEFINITIONS.map((def) => {
@@ -24608,6 +24591,7 @@ ${buildScopedContext(pageContent, mode)}`;
       }
       return withAction(runtime2, tabManager, "navigate", { url }, async () => {
         const id = tabManager.getActiveTabId();
+        if (!id) return asNoActiveTabResponse();
         const navError = tabManager.navigateTab(id, url, postBody);
         if (navError) return navError;
         const { httpStatus } = await waitForLoadWithStatus(
@@ -24731,7 +24715,9 @@ ${buildScopedContext(pageContent, mode)}`;
           return "No previous page in history";
         }
         const beforeUrl = tab.view.webContents.getURL();
-        tabManager.goBack(tabManager.getActiveTabId());
+        const backId = tabManager.getActiveTabId();
+        if (!backId) return asNoActiveTabResponse();
+        tabManager.goBack(backId);
         await waitForLoad(tab.view.webContents);
         const afterUrl = tab.view.webContents.getURL();
         return afterUrl !== beforeUrl ? `Went back to ${afterUrl}` : `Back action completed but page stayed on ${afterUrl}`;
@@ -24752,7 +24738,9 @@ ${buildScopedContext(pageContent, mode)}`;
           return "No forward page in history";
         }
         const beforeUrl = tab.view.webContents.getURL();
-        tabManager.goForward(tabManager.getActiveTabId());
+        const forwardId = tabManager.getActiveTabId();
+        if (!forwardId) return asNoActiveTabResponse();
+        tabManager.goForward(forwardId);
         await waitForLoad(tab.view.webContents);
         const afterUrl = tab.view.webContents.getURL();
         return afterUrl !== beforeUrl ? `Went forward to ${afterUrl}` : `Forward action completed but page stayed on ${afterUrl}`;
@@ -24769,7 +24757,9 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asNoActiveTabResponse();
       return withAction(runtime2, tabManager, "reload", {}, async () => {
-        tabManager.reloadTab(tabManager.getActiveTabId());
+        const reloadId = tabManager.getActiveTabId();
+        if (!reloadId) return asNoActiveTabResponse();
+        tabManager.reloadTab(reloadId);
         await waitForLoad(tab.view.webContents);
         return `Reloaded ${tab.view.webContents.getURL()}`;
       });
@@ -25638,7 +25628,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
             void 0,
             h.color
           ).catch(
-            (err) => logger$a.warn("Failed to restore highlight after removal:", err)
+            (err) => logger$b.warn("Failed to restore highlight after removal:", err)
           );
         }
       }
@@ -25905,7 +25895,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       try {
         page = await extractContent$1(wc);
       } catch (err) {
-        logger$a.warn("Failed to extract page while generating suggestions:", err);
+        logger$b.warn("Failed to extract page while generating suggestions:", err);
         return asTextResponse(
           "Could not read page. Try navigate to a working URL."
         );
@@ -26079,6 +26069,7 @@ ${results.join("\n")}`;
           const steps = [];
           if (url) {
             const id = tabManager.getActiveTabId();
+            if (!id) return asNoActiveTabResponse();
             tabManager.navigateTab(id, url);
             await waitForLoad(wc);
             steps.push(`Navigated to ${wc.getURL()}`);
@@ -26515,7 +26506,7 @@ ${JSON.stringify(tableJson, null, 2)}`;
         try {
           targetDomain = new URL(tab.state.url).hostname;
         } catch (err) {
-          logger$a.warn("Failed to parse active tab URL for vault_status:", err);
+          logger$b.warn("Failed to parse active tab URL for vault_status:", err);
           return asErrorTextResponse("Could not parse active tab URL");
         }
       }
@@ -26583,7 +26574,7 @@ Use vault_login to fill the login form. Credentials are filled directly — you
       try {
         hostname = new URL(tab.state.url).hostname;
       } catch (err) {
-        logger$a.warn("Failed to parse active tab URL for vault_login:", err);
+        logger$b.warn("Failed to parse active tab URL for vault_login:", err);
         return asErrorTextResponse("Could not parse active tab URL");
       }
       const matches = findEntriesForDomain(`https://${hostname}`);
@@ -26679,7 +26670,7 @@ Use vault_login to fill the login form. Credentials are filled directly — you
       try {
         hostname = new URL(tab.state.url).hostname;
       } catch (err) {
-        logger$a.warn("Failed to parse active tab URL for vault_totp:", err);
+        logger$b.warn("Failed to parse active tab URL for vault_totp:", err);
         return asErrorTextResponse("Could not parse active tab URL");
       }
       const matches = findEntriesForDomain(`https://${hostname}`);
@@ -27027,7 +27018,7 @@ function startMcpServer(tabManager, runtime2, port) {
         await mcpServer.connect(transport);
         await transport.handleRequest(req, res);
       } catch (error) {
-        logger$a.error("Error handling request:", error);
+        logger$b.error("Error handling request:", error);
         if (!res.headersSent) {
           res.writeHead(500, { "Content-Type": "application/json" });
           res.end(
@@ -27046,7 +27037,7 @@ function startMcpServer(tabManager, runtime2, port) {
     };
     server.once("error", (error) => {
       const message = error.code === "EADDRINUSE" ? `Port ${port} is already in use. MCP server not started.` : error.message;
-      logger$a.error("Server error:", error);
+      logger$b.error("Server error:", error);
       clearMcpAuthFile();
       setMcpHealth({
         configuredPort: port,
@@ -27078,7 +27069,7 @@ function startMcpServer(tabManager, runtime2, port) {
         message: `MCP server listening on ${endpoint}.`
       });
       if (process.env.VESSEL_DEBUG_MCP === "1" || process.env.VESSEL_DEBUG_MCP === "true") {
-        logger$a.info(`Server listening on ${endpoint} (auth enabled)`);
+        logger$b.info(`Server listening on ${endpoint} (auth enabled)`);
       }
       if (mcpRuntimeState.authToken) {
         writeMcpAuthFile(endpoint, mcpRuntimeState.authToken);
@@ -27117,12 +27108,13 @@ function stopMcpServer() {
         message: "MCP server is stopped."
       });
       if (process.env.VESSEL_DEBUG_MCP === "1" || process.env.VESSEL_DEBUG_MCP === "true") {
-        logger$a.info("Server stopped");
+        logger$b.info("Server stopped");
       }
       resolve();
     });
   });
 }
+const logger$a = createLogger("Feedback");
 const SUPPORT_API = process.env.VESSEL_SUPPORT_API || process.env.VESSEL_PREMIUM_API || "https://vesselpremium.quantaintellect.com";
 const MAX_FEEDBACK_MESSAGE_LENGTH = 5e3;
 const FEEDBACK_REQUEST_TIMEOUT_MS = 15e3;
@@ -27158,7 +27150,11 @@ async function submitFeedback(payload) {
         source: payload.source
       })
     });
-    const data = await res.json().catch(() => ({}));
+    const data = await readJsonResponse(
+      res,
+      {},
+      (msg) => logger$a.warn("Failed to parse feedback response:", msg)
+    );
     if (!res.ok) {
       return errorResult(data.error || `HTTP ${res.status}`);
     }
@@ -29480,12 +29476,14 @@ function renderReportAsMarkdown(report, traces) {
 }
 const logger$4 = createLogger("ResearchIPC");
 function registerResearchHandlers(getOrchestrator) {
-  electron.ipcMain.handle(Channels.RESEARCH_STATE_GET, () => {
+  electron.ipcMain.handle(Channels.RESEARCH_STATE_GET, (event) => {
+    assertTrustedIpcSender(event);
     return getOrchestrator().getState();
   });
   electron.ipcMain.handle(
     Channels.RESEARCH_START_BRIEF,
-    async (_event, query) => {
+    async (event, query) => {
+      assertTrustedIpcSender(event);
       try {
         const trimmedQuery = query.trim();
         if (!trimmedQuery) {
@@ -29502,7 +29500,8 @@ function registerResearchHandlers(getOrchestrator) {
       }
     }
   );
-  electron.ipcMain.handle(Channels.RESEARCH_CONFIRM_BRIEF, () => {
+  electron.ipcMain.handle(Channels.RESEARCH_CONFIRM_BRIEF, (event) => {
+    assertTrustedIpcSender(event);
     try {
       if (isToolGated("research_confirm_brief")) {
         return { accepted: false, reason: "premium" };
@@ -29520,7 +29519,8 @@ function registerResearchHandlers(getOrchestrator) {
   });
   electron.ipcMain.handle(
     Channels.RESEARCH_APPROVE_OBJECTIVES,
-    (_event, options) => {
+    (event, options) => {
+      assertTrustedIpcSender(event);
       try {
         if (isToolGated("research_approve_objectives")) {
           return { accepted: false, reason: "premium" };
@@ -29546,23 +29546,28 @@ function registerResearchHandlers(getOrchestrator) {
   );
   electron.ipcMain.handle(
     Channels.RESEARCH_SET_MODE,
-    (_event, mode) => {
+    (event, mode) => {
+      assertTrustedIpcSender(event);
       getOrchestrator().setSupervisionMode(mode);
     }
   );
   electron.ipcMain.handle(
     Channels.RESEARCH_SET_TRACES,
-    (_event, include) => {
+    (event, include) => {
+      assertTrustedIpcSender(event);
       getOrchestrator().setIncludeTraces(include);
     }
   );
-  electron.ipcMain.handle(Channels.RESEARCH_CANCEL, () => {
+  electron.ipcMain.handle(Channels.RESEARCH_CANCEL, (event) => {
+    assertTrustedIpcSender(event);
     getOrchestrator().cancel();
   });
-  electron.ipcMain.handle(Channels.RESEARCH_STOP_AND_SYNTHESIZE, () => {
+  electron.ipcMain.handle(Channels.RESEARCH_STOP_AND_SYNTHESIZE, (event) => {
+    assertTrustedIpcSender(event);
     getOrchestrator().stopAndSynthesizeCurrentFindings();
   });
-  electron.ipcMain.handle(Channels.RESEARCH_EXPORT_REPORT, async () => {
+  electron.ipcMain.handle(Channels.RESEARCH_EXPORT_REPORT, async (event) => {
+    assertTrustedIpcSender(event);
     try {
       if (isToolGated("research_export_report")) {
         return { accepted: false, reason: "premium" };