@quanta-intellect/vessel-browser 0.1.14 → 0.1.15

package/out/main/index.js

@@ -8,11 +8,125 @@ const Anthropic = require("@anthropic-ai/sdk");
 const OpenAI = require("openai");
 const zod = require("zod");
 const path$1 = require("node:path");
-const node_crypto = require("node:crypto");
+const crypto$1 = require("node:crypto");
 const http = require("node:http");
 const os = require("node:os");
 const mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 const streamableHttp_js = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const defaults = {
+  defaultUrl: "https://start.duckduckgo.com",
+  theme: "dark",
+  sidebarWidth: 340,
+  mcpPort: 3100,
+  autoRestoreSession: true,
+  clearBookmarksOnLaunch: false,
+  obsidianVaultPath: "",
+  approvalMode: "confirm-dangerous",
+  agentTranscriptMode: "summary",
+  chatProvider: null,
+  maxToolIterations: 200,
+  domainPolicy: { allowedDomains: [], blockedDomains: [] },
+  downloadPath: ""
+};
+const SETTABLE_KEYS = new Set(Object.keys(defaults));
+let settings = null;
+let settingsIssues = [];
+function getSettingsPath() {
+  return path.join(electron.app.getPath("userData"), "vessel-settings.json");
+}
+function getSettingsLoadIssues() {
+  return settingsIssues.map((issue) => ({ ...issue }));
+}
+function sanitizePort(value) {
+  const parsed = Number(value);
+  if (Number.isInteger(parsed) && parsed >= 1 && parsed <= 65535) {
+    return parsed;
+  }
+  settingsIssues.push({
+    code: "settings-invalid-mcp-port",
+    severity: "warning",
+    title: "Invalid MCP port in settings",
+    detail: `Expected an integer between 1 and 65535 but found ${JSON.stringify(value)}.`,
+    action: `Using default port ${defaults.mcpPort} instead.`
+  });
+  return defaults.mcpPort;
+}
+function loadSettings() {
+  if (settings) return settings;
+  settingsIssues = [];
+  try {
+    const raw = fs.readFileSync(getSettingsPath(), "utf-8");
+    const parsed = JSON.parse(raw);
+    delete parsed.apiKey;
+    delete parsed.provider;
+    settings = {
+      ...defaults,
+      ...parsed,
+      mcpPort: sanitizePort(parsed.mcpPort ?? defaults.mcpPort),
+      agentTranscriptMode: parsed.agentTranscriptMode === "off" || parsed.agentTranscriptMode === "summary" || parsed.agentTranscriptMode === "full" ? parsed.agentTranscriptMode : parsed.showAgentTranscript === false ? "off" : defaults.agentTranscriptMode
+    };
+  } catch (error) {
+    if (fs.existsSync(getSettingsPath())) {
+      settingsIssues.push({
+        code: "settings-read-failed",
+        severity: "warning",
+        title: "Could not read Vessel settings",
+        detail: error instanceof Error ? error.message : "Unknown settings error.",
+        action: "Falling back to built-in defaults for this launch."
+      });
+    }
+    settings = { ...defaults };
+  }
+  return settings;
+}
+function saveSettings() {
+  try {
+    fs.mkdirSync(path.dirname(getSettingsPath()), { recursive: true });
+    fs.writeFileSync(getSettingsPath(), JSON.stringify(settings, null, 2));
+  } catch (err) {
+    console.error("[Vessel] Failed to save settings:", err);
+  }
+}
+function setSetting(key, value) {
+  loadSettings();
+  if (key === "mcpPort") {
+    settings.mcpPort = sanitizePort(value);
+  } else {
+    settings[key] = value;
+  }
+  saveSettings();
+  return { ...settings };
+}
+function checkDomainPolicy(url) {
+  if (!url || url.startsWith("about:")) return null;
+  const settings2 = loadSettings();
+  const policy = settings2.domainPolicy;
+  if (policy.allowedDomains.length === 0 && policy.blockedDomains.length === 0) {
+    return null;
+  }
+  let hostname;
+  try {
+    hostname = new URL(url).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+  if (policy.allowedDomains.length > 0) {
+    const allowed = policy.allowedDomains.some(
+      (d) => matchesDomain(hostname, d.toLowerCase())
+    );
+    return allowed ? null : `Navigation blocked by domain policy: ${hostname} is not in the allowed domains list.`;
+  }
+  if (policy.blockedDomains.length > 0) {
+    const blocked = policy.blockedDomains.some(
+      (d) => matchesDomain(hostname, d.toLowerCase())
+    );
+    return blocked ? `Navigation blocked by domain policy: ${hostname} is in the blocked domains list.` : null;
+  }
+  return null;
+}
+function matchesDomain(hostname, policyDomain) {
+  return hostname === policyDomain || hostname.endsWith("." + policyDomain);
+}
 const MAX_CUSTOM_HISTORY = 50;
 class Tab {
   id;
@@ -60,7 +174,8 @@ class Tab {
       canGoBack: false,
       canGoForward: false,
       isReaderMode: false,
-      adBlockingEnabled: options?.adBlockingEnabled ?? true
+      adBlockingEnabled: options?.adBlockingEnabled ?? true,
+      role: options?.role
     };
     this.view.webContents.on("before-input-event", (_event, input) => {
       if (!input.control && !input.meta) return;
@@ -250,7 +365,13 @@ class Tab {
         url = `https://duckduckgo.com/?q=${encodeURIComponent(url)}`;
       }
     }
+    if (!/^https?:\/\//i.test(url) && !url.startsWith("about:")) {
+      return `Blocked navigation to disallowed URL scheme: ${url.slice(0, 80)}`;
+    }
+    const policyError = checkDomainPolicy(url);
+    if (policyError) return policyError;
     this.view.webContents.loadURL(url);
+    return null;
   }
   goBack() {
     const previousUrl = this.urlHistory.pop();
@@ -388,31 +509,35 @@ class Tab {
     this.view.webContents.close();
   }
 }
-let state$2 = null;
-const listeners$1 = /* @__PURE__ */ new Set();
+let state$3 = null;
+const listeners$2 = /* @__PURE__ */ new Set();
 function getHighlightsPath() {
   return path.join(electron.app.getPath("userData"), "vessel-highlights.json");
 }
-function load$1() {
-  if (state$2) return state$2;
+function load$2() {
+  if (state$3) return state$3;
   try {
     const raw = fs.readFileSync(getHighlightsPath(), "utf-8");
     const parsed = JSON.parse(raw);
-    state$2 = {
+    state$3 = {
       highlights: Array.isArray(parsed.highlights) ? parsed.highlights : []
     };
   } catch {
-    state$2 = { highlights: [] };
+    state$3 = { highlights: [] };
   }
-  return state$2;
+  return state$3;
 }
-function save$1() {
-  fs.writeFileSync(getHighlightsPath(), JSON.stringify(state$2, null, 2), "utf-8");
+function save$2() {
+  try {
+    fs.writeFileSync(getHighlightsPath(), JSON.stringify(state$3, null, 2), "utf-8");
+  } catch (err) {
+    console.error("[Vessel] Failed to save highlights:", err);
+  }
 }
-function emit$1() {
-  if (!state$2) return;
-  const snapshot = { highlights: [...state$2.highlights] };
-  for (const listener of listeners$1) {
+function emit$2() {
+  if (!state$3) return;
+  const snapshot = { highlights: [...state$3.highlights] };
+  for (const listener of listeners$2) {
     listener(snapshot);
   }
 }
@@ -425,17 +550,17 @@ function normalizeUrl(rawUrl) {
     return rawUrl;
   }
 }
-function getState$1() {
-  load$1();
-  return { highlights: [...state$2.highlights] };
+function getState$2() {
+  load$2();
+  return { highlights: [...state$3.highlights] };
 }
 function getHighlightsForUrl(url) {
-  load$1();
+  load$2();
   const normalized = normalizeUrl(url);
-  return state$2.highlights.filter((h) => h.url === normalized);
+  return state$3.highlights.filter((h) => h.url === normalized);
 }
 function addHighlight(url, selector, text, label, color, source) {
-  load$1();
+  load$2();
   const highlight = {
     id: crypto.randomUUID(),
     url: normalizeUrl(url),
@@ -446,45 +571,45 @@ function addHighlight(url, selector, text, label, color, source) {
     source: source || void 0,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  state$2.highlights.push(highlight);
-  save$1();
-  emit$1();
+  state$3.highlights.push(highlight);
+  save$2();
+  emit$2();
   return highlight;
 }
 function removeHighlight(id) {
-  load$1();
-  const index = state$2.highlights.findIndex((h) => h.id === id);
+  load$2();
+  const index = state$3.highlights.findIndex((h) => h.id === id);
   if (index === -1) return null;
-  const [removed] = state$2.highlights.splice(index, 1);
-  save$1();
-  emit$1();
+  const [removed] = state$3.highlights.splice(index, 1);
+  save$2();
+  emit$2();
   return removed;
 }
 function findHighlightByText(url, text) {
-  load$1();
+  load$2();
   const normalized = normalizeUrl(url);
-  return state$2.highlights.find(
+  return state$3.highlights.find(
     (h) => h.url === normalized && h.text && h.text === text
   ) ?? null;
 }
 function updateHighlightColor(id, color) {
-  load$1();
-  const highlight = state$2.highlights.find((h) => h.id === id);
+  load$2();
+  const highlight = state$3.highlights.find((h) => h.id === id);
   if (!highlight) return null;
   highlight.color = color;
-  save$1();
-  emit$1();
+  save$2();
+  emit$2();
   return highlight;
 }
 function clearHighlightsForUrl(url) {
-  load$1();
+  load$2();
   const normalized = normalizeUrl(url);
-  const before = state$2.highlights.length;
-  state$2.highlights = state$2.highlights.filter((h) => h.url !== normalized);
-  const removed = before - state$2.highlights.length;
+  const before = state$3.highlights.length;
+  state$3.highlights = state$3.highlights.filter((h) => h.url !== normalized);
+  const removed = before - state$3.highlights.length;
   if (removed > 0) {
-    save$1();
-    emit$1();
+    save$2();
+    emit$2();
   }
   return removed;
 }
@@ -824,6 +949,172 @@ async function highlightOnPage(wc, resolvedSelector, text, label, durationMs, co
   }
   return "Error: No element or text to highlight";
 }
+async function highlightBatchOnPage(wc, entries) {
+  if (entries.length === 0) return;
+  const serialized = entries.filter((e) => e.selector || e.text).map((e) => ({
+    selector: e.selector ?? null,
+    text: e.text ?? null,
+    label: e.label ?? null,
+    color: resolveColor(e.color)
+  }));
+  if (serialized.length === 0) return;
+  await wc.executeJavaScript(`
+    (function() {
+      if (!document.getElementById('__vessel-highlight-styles')) {
+        var s = document.createElement('style');
+        s.id = '__vessel-highlight-styles';
+        s.textContent = ${JSON.stringify(VESSEL_HIGHLIGHT_CSS)};
+        document.head.appendChild(s);
+      }
+      var entries = ${JSON.stringify(serialized)};
+      var SKIP_TAGS = {SCRIPT:1,STYLE:1,NOSCRIPT:1,TEMPLATE:1,IFRAME:1,SVG:1};
+      var contentRoots = ['main', 'article', '[role="main"]', '#mw-content-text', '.mw-parser-output', '#content', '.post-content', '.entry-content', '.article-body'];
+      var NAV_ANCESTORS = 'nav, aside, footer, header, [role="navigation"], [role="complementary"], .sidebar, .navbox, .infobox, figcaption, .thumbcaption, .mw-jump-link';
+      var contentRoot = null;
+      for (var cr = 0; cr < contentRoots.length; cr++) {
+        contentRoot = document.querySelector(contentRoots[cr]);
+        if (contentRoot) break;
+      }
+
+      function collectMatches(root, searchText, foldedSearchText, limit) {
+        var matches = [];
+        var w = document.createTreeWalker(root, NodeFilter.SHOW_TEXT, {
+          acceptNode: function(n) {
+            var p = n.parentElement;
+            if (!p) return NodeFilter.FILTER_REJECT;
+            if (SKIP_TAGS[p.tagName]) return NodeFilter.FILTER_REJECT;
+            if (p.closest('[data-vessel-highlight]')) return NodeFilter.FILTER_REJECT;
+            if (p.closest(NAV_ANCESTORS)) return NodeFilter.FILTER_REJECT;
+            var style = window.getComputedStyle(p);
+            if (style.display === 'none' || style.visibility === 'hidden' || style.opacity === '0') return NodeFilter.FILTER_REJECT;
+            if (p.offsetWidth === 0 && p.offsetHeight === 0) return NodeFilter.FILTER_REJECT;
+            return NodeFilter.FILTER_ACCEPT;
+          }
+        });
+        var n;
+        while ((n = w.nextNode())) {
+          var haystack = n.textContent || '';
+          var idx = haystack.indexOf(searchText);
+          if (idx === -1 && foldedSearchText) {
+            idx = haystack.toLowerCase().indexOf(foldedSearchText);
+          }
+          if (idx !== -1) {
+            matches.push({ node: n, idx: idx });
+            if (matches.length >= limit) break;
+          }
+        }
+        return matches;
+      }
+
+      for (var e = 0; e < entries.length; e++) {
+        var entry = entries[e];
+        var c = entry.color;
+        if (entry.text) {
+          var searchText = (entry.text || '').trim();
+          var foldedSearchText = searchText.toLowerCase();
+          var textNodes = contentRoot ? collectMatches(contentRoot, searchText, foldedSearchText, 20) : [];
+          if (textNodes.length === 0) {
+            textNodes = collectMatches(document.body, searchText, foldedSearchText, 20);
+          }
+          for (var i = 0; i < textNodes.length; i++) {
+            try {
+              var match = textNodes[i];
+              var range = document.createRange();
+              range.setStart(match.node, match.idx);
+              range.setEnd(match.node, match.idx + searchText.length);
+              var mark = document.createElement('mark');
+              mark.className = '__vessel-highlight-text';
+              mark.style.setProperty('background', c.bg, 'important');
+              mark.style.setProperty('border-bottom-color', c.solid, 'important');
+              mark.setAttribute('data-vessel-highlight', 'true');
+              range.surroundContents(mark);
+            } catch (_e) {}
+          }
+        } else if (entry.selector) {
+          try {
+            var el = document.querySelector(entry.selector);
+            if (el) {
+              el.classList.add('__vessel-highlight');
+              el.style.setProperty('background', c.bg, 'important');
+              el.style.setProperty('outline-color', c.solid, 'important');
+              el.style.setProperty('box-shadow', '0 0 8px ' + c.glow, 'important');
+            }
+          } catch (_e) {}
+        }
+      }
+    })()
+  `);
+}
+const HIGHLIGHT_SELECTOR = "'.__vessel-highlight, .__vessel-highlight-text'";
+async function getHighlightCount(wc) {
+  return wc.executeJavaScript(
+    `document.querySelectorAll(${HIGHLIGHT_SELECTOR}).length`
+  );
+}
+async function scrollToHighlight(wc, index) {
+  const safeIndex = Math.floor(Number(index));
+  return wc.executeJavaScript(`
+    (function() {
+      var highlights = document.querySelectorAll(${HIGHLIGHT_SELECTOR});
+      if (${safeIndex} < 0 || ${safeIndex} >= highlights.length) return false;
+      highlights.forEach(function(h) { h.style.removeProperty('outline'); h.style.removeProperty('outline-offset'); });
+      var target = highlights[${safeIndex}];
+      target.scrollIntoView({ behavior: 'smooth', block: 'center' });
+      target.style.setProperty('outline', '2px solid rgba(255, 255, 255, 0.9)', 'important');
+      target.style.setProperty('outline-offset', '2px', 'important');
+      return true;
+    })()
+  `);
+}
+async function removeHighlightAtIndex(wc, index) {
+  const safeIndex = Math.floor(Number(index));
+  return wc.executeJavaScript(`
+    (function() {
+      var highlights = document.querySelectorAll(${HIGHLIGHT_SELECTOR});
+      if (${safeIndex} < 0 || ${safeIndex} >= highlights.length) return false;
+      var el = highlights[${safeIndex}];
+      document.querySelectorAll('.__vessel-highlight-label[data-vessel-highlight]').forEach(function(b) {
+        if (b.__vesselAnchor === el) b.remove();
+      });
+      if (el.tagName === 'MARK' && el.classList.contains('__vessel-highlight-text')) {
+        var parent = el.parentNode;
+        while (el.firstChild) parent.insertBefore(el.firstChild, el);
+        parent.removeChild(el);
+        parent.normalize();
+      } else {
+        el.classList.remove('__vessel-highlight');
+        el.style.removeProperty('background');
+        el.style.removeProperty('outline-color');
+        el.style.removeProperty('box-shadow');
+        el.style.removeProperty('outline');
+        el.style.removeProperty('outline-offset');
+      }
+      return true;
+    })()
+  `);
+}
+async function clearAllHighlightElements(wc) {
+  return wc.executeJavaScript(`
+    (function() {
+      document.querySelectorAll('.__vessel-highlight-label[data-vessel-highlight]').forEach(function(b) { b.remove(); });
+      document.querySelectorAll('.__vessel-highlight-text').forEach(function(mark) {
+        var parent = mark.parentNode;
+        while (mark.firstChild) parent.insertBefore(mark.firstChild, mark);
+        parent.removeChild(mark);
+        parent.normalize();
+      });
+      document.querySelectorAll('.__vessel-highlight').forEach(function(el) {
+        el.classList.remove('__vessel-highlight');
+        el.style.removeProperty('background');
+        el.style.removeProperty('outline-color');
+        el.style.removeProperty('box-shadow');
+        el.style.removeProperty('outline');
+        el.style.removeProperty('outline-offset');
+      });
+      return true;
+    })()
+  `);
+}
 async function clearHighlights(wc) {
   return wc.executeJavaScript(`
     (function() {
@@ -848,6 +1139,134 @@ async function clearHighlights(wc) {
     })()
   `);
 }
+const MAX_HIGHLIGHT_TEXT = 5e3;
+async function captureSelectionHighlight(wc) {
+  if (wc.isDestroyed()) {
+    return { success: false, message: "Tab is not available" };
+  }
+  const url = wc.getURL();
+  if (!url || url === "about:blank") {
+    return { success: false, message: "No page loaded" };
+  }
+  const selectedText = await wc.executeJavaScript(`
+    (function() {
+      var sel = window.getSelection();
+      return sel ? sel.toString().trim() : '';
+    })()
+  `);
+  if (!selectedText) {
+    return { success: false, message: "No text selected" };
+  }
+  return persistHighlight(url, selectedText);
+}
+async function persistAndMarkHighlight(wc, text) {
+  if (wc.isDestroyed()) {
+    return { success: false, message: "Tab is not available" };
+  }
+  const url = wc.getURL();
+  if (!url || url === "about:blank") {
+    return { success: false, message: "No page loaded" };
+  }
+  const result = persistHighlight(url, text);
+  return result;
+}
+function persistHighlight(url, text) {
+  const capped = text.length > MAX_HIGHLIGHT_TEXT ? text.slice(0, MAX_HIGHLIGHT_TEXT) : text;
+  const highlight = addHighlight(
+    url,
+    void 0,
+    capped,
+    void 0,
+    "yellow",
+    "user"
+  );
+  return { success: true, text: capped, id: highlight.id };
+}
+const MAX_HISTORY_ENTRIES = 5e3;
+let state$2 = null;
+const listeners$1 = /* @__PURE__ */ new Set();
+function getHistoryPath() {
+  return path.join(electron.app.getPath("userData"), "vessel-history.json");
+}
+function load$1() {
+  if (state$2) return state$2;
+  try {
+    const raw = fs.readFileSync(getHistoryPath(), "utf-8");
+    const parsed = JSON.parse(raw);
+    state$2 = {
+      entries: Array.isArray(parsed.entries) ? parsed.entries : []
+    };
+  } catch {
+    state$2 = { entries: [] };
+  }
+  return state$2;
+}
+function save$1() {
+  try {
+    fs.mkdirSync(path.dirname(getHistoryPath()), { recursive: true });
+    fs.writeFileSync(
+      getHistoryPath(),
+      JSON.stringify(state$2, null, 2),
+      "utf-8"
+    );
+  } catch (err) {
+    console.error("[Vessel] Failed to save history:", err);
+  }
+}
+function emit$1() {
+  if (!state$2) return;
+  const snapshot = { entries: [...state$2.entries] };
+  for (const listener of listeners$1) {
+    listener(snapshot);
+  }
+}
+function getState$1() {
+  load$1();
+  return { entries: [...state$2.entries] };
+}
+function subscribe$1(listener) {
+  listeners$1.add(listener);
+  return () => {
+    listeners$1.delete(listener);
+  };
+}
+function addEntry(url, title) {
+  if (!url || url === "about:blank") return;
+  load$1();
+  const last = state$2.entries[0];
+  if (last && last.url === url) {
+    if (title && title !== last.title) {
+      last.title = title;
+      save$1();
+      emit$1();
+    }
+    return;
+  }
+  const entry = {
+    url,
+    title: title || url,
+    visitedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  state$2.entries.unshift(entry);
+  if (state$2.entries.length > MAX_HISTORY_ENTRIES) {
+    state$2.entries = state$2.entries.slice(0, MAX_HISTORY_ENTRIES);
+  }
+  save$1();
+  emit$1();
+}
+function search(query, limit = 50) {
+  load$1();
+  if (!query.trim()) return state$2.entries.slice(0, limit);
+  const normalized = query.toLowerCase();
+  return state$2.entries.filter(
+    (e) => e.url.toLowerCase().includes(normalized) || e.title.toLowerCase().includes(normalized)
+  ).slice(0, limit);
+}
+function clearAll$1() {
+  state$2 = { entries: [] };
+  save$1();
+  emit$1();
+}
 const MAX_CONSOLE_ENTRIES = 500;
 const MAX_NETWORK_ENTRIES = 200;
 const MAX_ERROR_ENTRIES = 200;
@@ -1572,7 +1991,10 @@ class TabManager {
       onOpenUrl: ({ url: requestedUrl, background: background2, adBlockingEnabled }) => {
         this.createTab(requestedUrl, { background: background2, adBlockingEnabled });
       },
-      onPageLoad: (pageUrl, wc) => this.reapplyHighlights(pageUrl, wc),
+      onPageLoad: (pageUrl, wc) => {
+        this.reapplyHighlights(pageUrl, wc);
+        addEntry(pageUrl, wc.getTitle());
+      },
       onHighlightSelection: (wc) => this.captureHighlightFromPage(wc),
       onHighlightRemove: (url2, text) => this.removeHighlightByText(url2, text),
       onHighlightRecolor: (url2, text, color) => this.recolorHighlightByText(url2, text, color)
@@ -1724,16 +2146,14 @@ class TabManager {
     if (last && last.url === normalized && now - last.at < 500) return;
     this.lastReapply.set(wcId, { url: normalized, at: now });
     const highlights = getHighlightsForUrl(url);
-    for (const h of highlights) {
-      if (!h.selector && !h.text) continue;
-      void highlightOnPage(
-        wc,
-        h.selector ?? null,
-        h.text,
-        h.label,
-        void 0,
-        h.color
-      ).catch(() => {
+    const entries = highlights.filter((h) => h.selector || h.text).map((h) => ({
+      selector: h.selector ?? null,
+      text: h.text,
+      label: h.label,
+      color: h.color
+    }));
+    if (entries.length > 0) {
+      void highlightBatchOnPage(wc, entries).catch(() => {
       });
     }
   }
@@ -1741,62 +2161,23 @@ class TabManager {
     this.highlightCaptureCallback = callback;
   }
   captureHighlightFromActiveTab() {
-    console.log("[Vessel] captureHighlightFromActiveTab called");
     const activeTab = this.getActiveTab();
     if (!activeTab) {
-      console.log("[Vessel] No active tab in captureHighlightFromActiveTab");
       return { success: false, message: "No active tab" };
     }
     const wc = activeTab.view.webContents;
-    console.log("[Vessel] Calling captureHighlightFromPage for:", wc.getURL());
     this.captureHighlightFromPage(wc);
     return null;
   }
   captureHighlightFromPage(wc) {
-    console.log("[Vessel] captureHighlightFromPage called");
     void (async () => {
       try {
-        if (wc.isDestroyed()) {
-          console.log("[Vessel] WebContents destroyed");
-          return;
-        }
-        const url = wc.getURL();
-        console.log("[Vessel] URL:", url);
-        if (!url || url === "about:blank") {
-          console.log("[Vessel] No URL or about:blank");
-          return;
+        const result = await captureSelectionHighlight(wc);
+        if (result.success && result.text) {
+          await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(() => {
+          });
         }
-        const selectedText = await wc.executeJavaScript(`
-          (function() {
-            var sel = window.getSelection();
-            return sel ? sel.toString().trim() : '';
-          })()
-        `);
-        console.log("[Vessel] Selected text:", selectedText?.slice(0, 50));
-        if (!selectedText) return;
-        const capped = selectedText.length > 5e3 ? selectedText.slice(0, 5e3) : selectedText;
-        const highlight = addHighlight(
-          url,
-          void 0,
-          capped,
-          void 0,
-          "yellow",
-          "user"
-        );
-        await highlightOnPage(
-          wc,
-          null,
-          capped,
-          void 0,
-          void 0,
-          "yellow"
-        ).catch(() => {
-        });
-        this.highlightCaptureCallback?.({
-          success: true,
-          text: capped,
-          id: highlight.id
-        });
+        this.highlightCaptureCallback?.(result);
       } catch {
         this.highlightCaptureCallback?.({
           success: false,
@@ -1836,130 +2217,53 @@ class TabManager {
     }
     const normalized = normalizeUrl(url);
     for (const id of this.order) {
-      const tab = this.tabs.get(id);
-      if (!tab) continue;
-      const wc = tab.view.webContents;
-      if (wc.isDestroyed()) continue;
-      try {
-        const tabUrl = normalizeUrl(wc.getURL());
-        if (tabUrl === normalized) {
-          void this.removeHighlightMarksForText(wc, text).then(() => {
-            void highlightOnPage(
-              wc,
-              null,
-              text,
-              void 0,
-              void 0,
-              color
-            ).catch(() => {
-            });
-          });
-        }
-      } catch {
-      }
-    }
-    this.highlightCaptureCallback?.({
-      success: true,
-      message: `Color changed to ${color}`
-    });
-  }
-  async removeHighlightMarksForText(wc, text) {
-    await wc.executeJavaScript(
-      `(function() {
-        var marks = document.querySelectorAll('mark.__vessel-highlight-text[data-vessel-highlight]');
-        marks.forEach(function(m) {
-          if (m.textContent === ${JSON.stringify(text)}) {
-            var parent = m.parentNode;
-            while (m.firstChild) parent.insertBefore(m.firstChild, m);
-            m.remove();
-            if (parent) parent.normalize();
-          }
-        });
-      })()`
-    ).catch(() => {
-    });
-  }
-  broadcastState() {
-    const states = this.getAllStates();
-    this.onStateChange(states, this.activeTabId || "");
-  }
-}
-const defaults = {
-  defaultUrl: "https://start.duckduckgo.com",
-  theme: "dark",
-  sidebarWidth: 340,
-  mcpPort: 3100,
-  autoRestoreSession: true,
-  clearBookmarksOnLaunch: false,
-  obsidianVaultPath: "",
-  approvalMode: "confirm-dangerous",
-  agentTranscriptMode: "summary",
-  chatProvider: null,
-  maxToolIterations: 200
-};
-let settings = null;
-let settingsIssues = [];
-function getSettingsPath() {
-  return path.join(electron.app.getPath("userData"), "vessel-settings.json");
-}
-function getSettingsLoadIssues() {
-  return settingsIssues.map((issue) => ({ ...issue }));
-}
-function sanitizePort(value) {
-  const parsed = Number(value);
-  if (Number.isInteger(parsed) && parsed >= 1 && parsed <= 65535) {
-    return parsed;
-  }
-  settingsIssues.push({
-    code: "settings-invalid-mcp-port",
-    severity: "warning",
-    title: "Invalid MCP port in settings",
-    detail: `Expected an integer between 1 and 65535 but found ${JSON.stringify(value)}.`,
-    action: `Using default port ${defaults.mcpPort} instead.`
-  });
-  return defaults.mcpPort;
-}
-function loadSettings() {
-  if (settings) return settings;
-  settingsIssues = [];
-  try {
-    const raw = fs.readFileSync(getSettingsPath(), "utf-8");
-    const parsed = JSON.parse(raw);
-    delete parsed.apiKey;
-    delete parsed.provider;
-    settings = {
-      ...defaults,
-      ...parsed,
-      mcpPort: sanitizePort(parsed.mcpPort ?? defaults.mcpPort),
-      agentTranscriptMode: parsed.agentTranscriptMode === "off" || parsed.agentTranscriptMode === "summary" || parsed.agentTranscriptMode === "full" ? parsed.agentTranscriptMode : parsed.showAgentTranscript === false ? "off" : defaults.agentTranscriptMode
-    };
-  } catch (error) {
-    if (fs.existsSync(getSettingsPath())) {
-      settingsIssues.push({
-        code: "settings-read-failed",
-        severity: "warning",
-        title: "Could not read Vessel settings",
-        detail: error instanceof Error ? error.message : "Unknown settings error.",
-        action: "Falling back to built-in defaults for this launch."
-      });
+      const tab = this.tabs.get(id);
+      if (!tab) continue;
+      const wc = tab.view.webContents;
+      if (wc.isDestroyed()) continue;
+      try {
+        const tabUrl = normalizeUrl(wc.getURL());
+        if (tabUrl === normalized) {
+          void this.removeHighlightMarksForText(wc, text).then(() => {
+            void highlightOnPage(
+              wc,
+              null,
+              text,
+              void 0,
+              void 0,
+              color
+            ).catch(() => {
+            });
+          });
+        }
+      } catch {
+      }
     }
-    settings = { ...defaults };
+    this.highlightCaptureCallback?.({
+      success: true,
+      message: `Color changed to ${color}`
+    });
   }
-  return settings;
-}
-function saveSettings() {
-  fs.mkdirSync(path.dirname(getSettingsPath()), { recursive: true });
-  fs.writeFileSync(getSettingsPath(), JSON.stringify(settings, null, 2));
-}
-function setSetting(key, value) {
-  loadSettings();
-  if (key === "mcpPort") {
-    settings.mcpPort = sanitizePort(value);
-  } else {
-    settings[key] = value;
+  async removeHighlightMarksForText(wc, text) {
+    await wc.executeJavaScript(
+      `(function() {
+        var marks = document.querySelectorAll('mark.__vessel-highlight-text[data-vessel-highlight]');
+        marks.forEach(function(m) {
+          if (m.textContent === ${JSON.stringify(text)}) {
+            var parent = m.parentNode;
+            while (m.firstChild) parent.insertBefore(m.firstChild, m);
+            m.remove();
+            if (parent) parent.normalize();
+          }
+        });
+      })()`
+    ).catch(() => {
+    });
+  }
+  broadcastState() {
+    const states = this.getAllStates();
+    this.onStateChange(states, this.activeTabId || "");
   }
-  saveSettings();
-  return { ...settings };
 }
 const Channels = {
   // Tab management
@@ -2025,6 +2329,21 @@ const Channels = {
   // DevTools panel
   DEVTOOLS_PANEL_TOGGLE: "devtools-panel:toggle",
   DEVTOOLS_PANEL_STATE: "devtools-panel:state",
+  DEVTOOLS_PANEL_RESIZE: "devtools-panel:resize",
+  // Find in page
+  FIND_IN_PAGE_START: "find:start",
+  FIND_IN_PAGE_NEXT: "find:next",
+  FIND_IN_PAGE_STOP: "find:stop",
+  FIND_IN_PAGE_RESULT: "find:result",
+  // Browsing history
+  HISTORY_GET: "history:get",
+  HISTORY_SEARCH: "history:search",
+  HISTORY_CLEAR: "history:clear",
+  HISTORY_UPDATE: "history:update",
+  // Downloads
+  DOWNLOAD_STARTED: "download:started",
+  DOWNLOAD_PROGRESS: "download:progress",
+  DOWNLOAD_DONE: "download:done",
   // Window controls
   WINDOW_MINIMIZE: "window:minimize",
   WINDOW_MAXIMIZE: "window:maximize",
@@ -3146,6 +3465,16 @@ const DIRECT_EXTRACTION_SCRIPT = String.raw`
         "dialog, [role='dialog'], [role='alertdialog'], [aria-modal='true']"
       ).forEach(function(el) { candidates.add(el); });
 
+      // Known consent manager containers — these are often missed by generic
+      // heuristics because they use custom stacking or non-standard z-indices
+      document.body.querySelectorAll(
+        '#onetrust-consent-sdk, #CybotCookiebotDialog, [class*="consent-banner"], ' +
+        '[class*="cookie-banner"], [class*="privacy-banner"], [id*="consent-wall"], ' +
+        '.fc-consent-root, #sp_message_container_, [id*="trustarc"], ' +
+        '[class*="cmp-"], [id*="cmp-container"], [class*="gdpr"], ' +
+        '[data-testid*="consent"], [data-testid*="cookie"], [data-testid*="privacy"]'
+      ).forEach(function(el) { candidates.add(el); });
+
       // Fixed/sticky elements are the other overlay category — walk only
       // direct children of body and high-level containers (depth ≤ 3)
       // since real overlays are almost always near the top of the DOM tree.
@@ -3173,13 +3502,23 @@ const DIRECT_EXTRACTION_SCRIPT = String.raw`
         var cartConfirm = !dialogLike && !drawerLike && isPositioned(style) &&
           rect.width >= 160 && rect.height >= 100 &&
           looksLikeCartConfirmation(node);
+        // Body scroll-lock + large fixed element is a strong overlay signal
+        // even without high z-index or exact center coverage
+        var bodyLocked = (function() {
+          var bs = window.getComputedStyle(document.body);
+          var hs = window.getComputedStyle(document.documentElement);
+          return bs.overflow === "hidden" || hs.overflow === "hidden";
+        })();
         var blocksInteraction = dialogLike ||
           drawerLike ||
           cartConfirm ||
           ((style.position === "fixed" || style.position === "sticky") &&
             parseZIndex(style) >= 10 &&
             areaRatio >= 0.3 &&
-            coversViewportCenter(rect));
+            coversViewportCenter(rect)) ||
+          (bodyLocked &&
+            (style.position === "fixed" || style.position === "sticky") &&
+            areaRatio >= 0.2);
 
         if (!blocksInteraction && type !== "dialog" && type !== "modal") return;
 
@@ -4006,9 +4345,12 @@ function generateReaderHTML(page) {
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-let mcpStatusChangeListener = null;
+const mcpStatusChangeListeners = /* @__PURE__ */ new Set();
 function onMcpStatusChange(listener) {
-  mcpStatusChangeListener = listener;
+  mcpStatusChangeListeners.add(listener);
+  return () => {
+    mcpStatusChangeListeners.delete(listener);
+  };
 }
 function getMcpStatus() {
   return state$1.mcp.status;
@@ -4059,7 +4401,9 @@ function setMcpHealth(update) {
   state$1.mcp.status = update.status;
   state$1.mcp.message = update.message;
   if (prevStatus !== state$1.mcp.status) {
-    mcpStatusChangeListener?.(state$1.mcp.status);
+    for (const listener of mcpStatusChangeListeners) {
+      listener(state$1.mcp.status);
+    }
   }
 }
 const DEFAULT_MAX_ITERATIONS$1 = 200;
@@ -6356,6 +6700,7 @@ const TOOL_DEFINITIONS = [
     description: "Read the current page using a scoped mode. Defaults to a minimal navigation-focused brief; use mode='debug' only when narrower modes are insufficient.",
     inputSchema: {
       mode: zod.z.enum([
+        "glance",
         "summary",
         "interactives_only",
         "forms_only",
@@ -6365,7 +6710,7 @@ const TOOL_DEFINITIONS = [
         "full",
         "debug"
       ]).optional().describe(
-        "Read mode: visible_only/results_only/forms_only/summary/text_only for narrow reads, full/debug for the complete page dump"
+        "Read mode: glance (fastest — viewport snapshot, no JS extraction, ideal for heavy pages), visible_only/results_only/forms_only/summary/text_only for narrow reads, full/debug for the complete page dump"
       )
     },
     tier: 0
@@ -7069,8 +7414,12 @@ function load() {
   return state;
 }
 function save() {
-  fs.mkdirSync(path.dirname(getBookmarksPath()), { recursive: true });
-  fs.writeFileSync(getBookmarksPath(), JSON.stringify(state, null, 2), "utf-8");
+  try {
+    fs.mkdirSync(path.dirname(getBookmarksPath()), { recursive: true });
+    fs.writeFileSync(getBookmarksPath(), JSON.stringify(state, null, 2), "utf-8");
+  } catch (err) {
+    console.error("[Vessel] Failed to save bookmarks:", err);
+  }
 }
 function emit() {
   if (!state) return;
@@ -7496,6 +7845,22 @@ function formatDeadLinkMessage(label, result) {
   const status = result.statusCode ? `HTTP ${result.statusCode}` : "dead link";
   return `Skipped stale link "${label}" because ${destination} returned ${status}. Try a different link or URL instead.`;
 }
+const ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+function isSafeNavigationURL(url) {
+  try {
+    const parsed = new URL(url);
+    return ALLOWED_SCHEMES.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+function assertSafeURL(url) {
+  if (!isSafeNavigationURL(url)) {
+    throw new Error(
+      `Blocked navigation to disallowed URL scheme: ${url.slice(0, 80)}`
+    );
+  }
+}
 const SESSION_VERSION = 1;
 function getSessionsDir() {
   return path$1.join(electron.app.getPath("userData"), "named-sessions");
@@ -7515,7 +7880,7 @@ function normalizeSessionName(name) {
 function sessionFileName(name) {
   const normalized = normalizeSessionName(name).toLowerCase();
   const slug = normalized.replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "session";
-  const hash = node_crypto.createHash("sha256").update(normalized).digest("hex").slice(0, 8);
+  const hash = crypto$1.createHash("sha256").update(normalized).digest("hex").slice(0, 8);
   return `${slug}-${hash}.json`;
 }
 function getSessionPath(name) {
@@ -7780,10 +8145,148 @@ const PAGE_SCRIPT_TIMEOUT = /* @__PURE__ */ Symbol("page-script-timeout");
 function pageBusyError(action) {
   return `Error: Page is still busy; ${action} timed out waiting for page scripts. Retry in a moment.`;
 }
+async function glanceExtract(wc) {
+  const startMs = Date.now();
+  const result = await executePageScript(
+    wc,
+    `(function() {
+      var vw = window.innerWidth || document.documentElement.clientWidth || 0;
+      var vh = window.innerHeight || document.documentElement.clientHeight || 0;
+      var sy = window.scrollY || window.pageYOffset || 0;
+
+      function inViewport(el) {
+        var r = el.getBoundingClientRect();
+        return r.bottom > 0 && r.top < vh && r.right > 0 && r.left < vw && r.width > 0 && r.height > 0;
+      }
+
+      function label(el) {
+        return (el.getAttribute('aria-label') || el.textContent || '').trim().slice(0, 120);
+      }
+
+      // Headings visible on screen
+      var headings = [];
+      document.querySelectorAll('h1, h2, h3, h4').forEach(function(h) {
+        if (!inViewport(h)) return;
+        var t = (h.textContent || '').trim();
+        if (t && t.length < 200) headings.push(h.tagName.toLowerCase() + ': ' + t);
+      });
+
+      // Links visible on screen (deduplicated by text)
+      var links = [];
+      var seenLinks = {};
+      var idx = 1;
+      document.querySelectorAll('a[href]').forEach(function(a) {
+        if (!inViewport(a)) return;
+        var t = (a.textContent || '').trim().slice(0, 100);
+        if (!t || t.length < 2 || seenLinks[t]) return;
+        seenLinks[t] = true;
+        links.push({ text: t, href: (a.href || '').slice(0, 200), index: idx++ });
+      });
+
+      // Buttons visible on screen
+      var buttons = [];
+      document.querySelectorAll('button, [role="button"], input[type="submit"], input[type="button"]').forEach(function(b) {
+        if (!inViewport(b)) return;
+        var t = label(b);
+        if (!t || t.length < 1) return;
+        buttons.push({ text: t, index: idx++ });
+      });
+
+      // Input fields visible on screen
+      var inputs = [];
+      document.querySelectorAll('input:not([type="hidden"]):not([type="submit"]):not([type="button"]), select, textarea').forEach(function(inp) {
+        if (!inViewport(inp)) return;
+        var type = (inp.type || inp.tagName.toLowerCase() || '').toLowerCase();
+        var lbl = (inp.getAttribute('aria-label') || inp.getAttribute('placeholder') || inp.name || '').trim();
+        inputs.push({ type: type, label: lbl.slice(0, 80), placeholder: (inp.getAttribute('placeholder') || '').slice(0, 80), index: idx++ });
+      });
+
+      // Content snapshot from main content area using textContent (instant, no reflow)
+      var roots = ['main', 'article', '[role="main"]', '#content', '.content', '.story-body'];
+      var contentRoot = null;
+      for (var i = 0; i < roots.length; i++) {
+        contentRoot = document.querySelector(roots[i]);
+        if (contentRoot && contentRoot.textContent.trim().length > 50) break;
+        contentRoot = null;
+      }
+      var snippet = '';
+      if (contentRoot) {
+        snippet = contentRoot.textContent.replace(/[ \\t]+/g, ' ').replace(/(\\n\\s*){3,}/g, '\\n\\n').trim().slice(0, 8000);
+      } else {
+        // Fallback: grab text from visible elements only
+        var parts = [];
+        document.querySelectorAll('h1, h2, h3, p, li, td, span, div').forEach(function(el) {
+          if (parts.length > 100 || !inViewport(el)) return;
+          var t = (el.textContent || '').trim();
+          if (t.length > 10 && t.length < 500) parts.push(t);
+        });
+        snippet = parts.join('\\n').slice(0, 8000);
+      }
+
+      return {
+        title: document.title || '',
+        url: location.href,
+        headings: headings.slice(0, 20),
+        links: links.slice(0, 40),
+        buttons: buttons.slice(0, 20),
+        inputs: inputs.slice(0, 15),
+        contentSnippet: snippet,
+        viewportHeight: vh,
+        viewportWidth: vw,
+        scrollY: Math.round(sy),
+      };
+    })()`,
+    { timeoutMs: 2500, label: "glance-extract" }
+  );
+  const elapsed = Date.now() - startMs;
+  if (!result || result === PAGE_SCRIPT_TIMEOUT) {
+    return [
+      `# ${wc.getTitle() || "(untitled)"}`,
+      `URL: ${wc.getURL()}`,
+      "",
+      "[read_page mode=glance — page JS thread is completely blocked, no content available]",
+      "[Try: click or type_text to interact directly, or wait a few seconds and retry]"
+    ].join("\n");
+  }
+  const sections = [
+    `# ${result.title}`,
+    `URL: ${result.url}`,
+    `Viewport: ${result.viewportWidth}×${result.viewportHeight} scrollY=${result.scrollY}`,
+    `[read_page mode=glance — ${elapsed}ms, showing what's visible on screen]`
+  ];
+  if (result.headings.length > 0) {
+    sections.push("", "## Headings", ...result.headings);
+  }
+  if (result.inputs.length > 0) {
+    sections.push("", "## Input Fields");
+    for (const inp of result.inputs) {
+      const desc = inp.label || inp.placeholder || inp.type;
+      sections.push(`  [#${inp.index}] ${inp.type}: ${desc}`);
+    }
+  }
+  if (result.buttons.length > 0) {
+    sections.push("", "## Buttons");
+    for (const btn of result.buttons) {
+      sections.push(`  [#${btn.index}] ${btn.text}`);
+    }
+  }
+  if (result.links.length > 0) {
+    sections.push("", "## Visible Links");
+    for (const link of result.links) {
+      sections.push(`  [#${link.index}] ${link.text}`);
+    }
+  }
+  if (result.contentSnippet) {
+    const truncated = result.contentSnippet.length > 6e3 ? result.contentSnippet.slice(0, 6e3) + "\n[truncated]" : result.contentSnippet;
+    sections.push("", "## Page Content (viewport)", "", truncated);
+  }
+  return sections.join("\n");
+}
 function normalizeReadPageMode(mode, pageContent) {
   if (typeof mode === "string") {
     const normalized = mode.trim().toLowerCase();
     if (normalized === "debug") return "debug";
+    if (normalized === "glance") return "glance";
     if (normalized === "full" || normalized === "summary" || normalized === "interactives_only" || normalized === "forms_only" || normalized === "text_only" || normalized === "visible_only" || normalized === "results_only") {
       return normalized;
     }
@@ -7911,10 +8414,62 @@ function waitForPotentialNavigation$1(wc, beforeUrl, timeout = 2500) {
     wc.on("page-title-updated", onNativeChange);
   });
 }
-function getPostNavSummary(wc) {
+async function getPostNavSummary(wc) {
   const title = wc.getTitle();
-  return title ? `
+  const titleLine = title ? `
 Page title: ${title}` : "";
+  const overlaySignal = await executePageScript(
+    wc,
+    `(function() {
+      var signals = [];
+      // Body scroll lock is a strong overlay signal
+      var bodyStyle = window.getComputedStyle(document.body);
+      var htmlStyle = window.getComputedStyle(document.documentElement);
+      if (bodyStyle.overflow === 'hidden' || htmlStyle.overflow === 'hidden') {
+        signals.push('body-scroll-locked');
+      }
+      // Check for known consent manager containers
+      var consentSelectors = [
+        '#onetrust-consent-sdk', '#CybotCookiebotDialog', '[class*="consent-banner"]',
+        '[class*="cookie-banner"]', '[class*="privacy-banner"]', '[id*="consent"]',
+        '[class*="gdpr"]', '[data-testid*="consent"]', '[data-testid*="cookie"]',
+        '.fc-consent-root', '#sp_message_container_', '[id*="trustarc"]',
+        '[class*="cmp-"]', '[id*="cmp-"]'
+      ];
+      for (var i = 0; i < consentSelectors.length; i++) {
+        try {
+          var el = document.querySelector(consentSelectors[i]);
+          if (el && el.offsetHeight > 50) {
+            signals.push('consent-banner:' + consentSelectors[i]);
+            break;
+          }
+        } catch(e) {}
+      }
+      // Check for large fixed/sticky elements covering viewport
+      var vw = window.innerWidth || 0;
+      var vh = window.innerHeight || 0;
+      var vpArea = Math.max(1, vw * vh);
+      var els = document.querySelectorAll('dialog[open], [role="dialog"], [aria-modal="true"]');
+      if (els.length > 0) signals.push('dialog-open');
+      if (signals.length === 0) {
+        var fixed = document.querySelectorAll('div[style*="position: fixed"], div[style*="position:fixed"]');
+        for (var j = 0; j < fixed.length && j < 20; j++) {
+          var r = fixed[j].getBoundingClientRect();
+          if ((r.width * r.height) / vpArea > 0.3) {
+            signals.push('large-fixed-overlay');
+            break;
+          }
+        }
+      }
+      return signals.length > 0 ? signals.join(', ') : null;
+    })()`,
+    { timeoutMs: 1500, label: "overlay-probe" }
+  );
+  if (overlaySignal && overlaySignal !== PAGE_SCRIPT_TIMEOUT) {
+    return `${titleLine}
+WARNING: Blocking overlay detected (${overlaySignal}). Call clear_overlays or accept_cookies before reading the page.`;
+  }
+  return titleLine;
 }
 async function scrollPage$1(wc, deltaY) {
   const getScrollY = async () => {
@@ -8363,6 +8918,7 @@ async function restoreLocaleSnapshot(wc, snapshot) {
   }
   if (snapshot.url && snapshot.url !== wc.getURL()) {
     try {
+      assertSafeURL(snapshot.url);
       await wc.loadURL(snapshot.url);
       await waitForLoad$1(wc, 3e3);
       return;
@@ -9007,6 +9563,71 @@ async function clickOverlayCandidate(wc, action) {
   const result = await clickResolvedSelector$1(wc, action.selector);
   return `${action.label || action.selector}: ${result}`;
 }
+async function tryDismissConsentIframe(wc) {
+  try {
+    const hasSignal = await executePageScript(
+      wc,
+      `(function() {
+        var bs = window.getComputedStyle(document.body);
+        var hs = window.getComputedStyle(document.documentElement);
+        if (bs.overflow === 'hidden' || hs.overflow === 'hidden') return true;
+        var sels = '#onetrust-consent-sdk, [class*="consent"], [class*="cookie-banner"], [id*="consent"], [id*="sp_message"], .fc-consent-root, [class*="cmp-"]';
+        var el = document.querySelector(sels);
+        return !!(el && el.offsetHeight > 20);
+      })()`,
+      { timeoutMs: 1e3, label: "iframe-consent-signal" }
+    );
+    if (!hasSignal || hasSignal === PAGE_SCRIPT_TIMEOUT) return null;
+    const frames = wc.mainFrame.framesInSubtree;
+    for (const frame of frames) {
+      if (frame === wc.mainFrame) continue;
+      try {
+        const result = await frame.executeJavaScript(`
+          (function() {
+            var selectors = [
+              'button[title*="Accept"], button[title*="Agree"], button[title*="OK"]',
+              '[class*="accept"], [class*="agree"], [class*="consent-accept"]',
+              'button[aria-label*="accept" i], button[aria-label*="agree" i]',
+              '.sp_choice_type_11', '.message-component.message-button',
+            ];
+            // Try selectors first
+            for (var i = 0; i < selectors.length; i++) {
+              try {
+                var els = document.querySelectorAll(selectors[i]);
+                for (var j = 0; j < els.length; j++) {
+                  var el = els[j];
+                  if (!(el instanceof HTMLElement)) continue;
+                  var text = (el.textContent || '').trim().toLowerCase();
+                  if (/accept|agree|consent|got it|ok|continue|i understand/i.test(text) || el.offsetHeight > 0) {
+                    el.click();
+                    return 'Clicked iframe consent button: ' + text.slice(0, 60);
+                  }
+                }
+              } catch(e) {}
+            }
+            // Text-match fallback on all buttons
+            var buttons = document.querySelectorAll('button, [role="button"], a.message-component');
+            for (var k = 0; k < buttons.length; k++) {
+              var btn = buttons[k];
+              var label = (btn.textContent || '').trim().toLowerCase();
+              if (/^(accept|agree|accept all|i agree|i accept|ok|got it|allow|continue|yes)$/i.test(label) ||
+                  /accept all|agree and|accept & continue|accept and continue/i.test(label)) {
+                btn.click();
+                return 'Clicked iframe consent button: ' + label.slice(0, 60);
+              }
+            }
+            return null;
+          })()
+        `);
+        if (result) return result;
+      } catch {
+        continue;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 async function clearOverlays(wc, strategy = "auto") {
   const steps = [];
   let cleared = 0;
@@ -9018,7 +9639,15 @@ async function clearOverlays(wc, strategy = "auto") {
       (overlay2) => overlay2.blocksInteraction
     );
     if (blockingOverlays.length === 0) {
-      if (cleared === 0) return "No blocking overlays detected";
+      if (cleared === 0) {
+        const iframeResult = await tryDismissConsentIframe(wc);
+        if (iframeResult) {
+          steps.push(`Iframe consent: ${iframeResult}`);
+          await sleep$1(500);
+          return steps.join("\n");
+        }
+        return "No blocking overlays detected";
+      }
       steps.push(`Overlays remaining: ${beforeState.total}`);
       steps.push("Page still blocked: false");
       return steps.join("\n");
@@ -9870,6 +10499,7 @@ async function submitForm$1(wc, args) {
     if (formInfo.params) {
       url.search = formInfo.params;
     }
+    assertSafeURL(url.toString());
     wc.loadURL(url.toString());
     await waitForPotentialNavigation$1(wc, beforeUrl);
     const afterUrl = wc.getURL();
@@ -10164,7 +10794,7 @@ async function executeAction(name, args, ctx) {
           const created = ctx.tabManager.getActiveTab();
           if (created) {
             await waitForLoad$1(created.view.webContents);
-            return `Created tab ${createdId}${getPostNavSummary(created.view.webContents)}`;
+            return `Created tab ${createdId}${await getPostNavSummary(created.view.webContents)}`;
           }
           return `Created tab ${createdId}`;
         }
@@ -10176,7 +10806,7 @@ async function executeAction(name, args, ctx) {
           }
           ctx.tabManager.navigateTab(tabId, args.url);
           await waitForLoad$1(wc);
-          return `Navigated to ${wc.getURL()}${getPostNavSummary(wc)}`;
+          return `Navigated to ${wc.getURL()}${await getPostNavSummary(wc)}`;
         }
         case "go_back": {
           if (!tab || !wc || !tabId) return "Error: No active tab";
@@ -10187,7 +10817,7 @@ async function executeAction(name, args, ctx) {
           ctx.tabManager.goBack(tabId);
           await waitForLoad$1(wc);
           const afterUrl = wc.getURL();
-          return afterUrl !== beforeUrl ? `Went back to ${afterUrl}${getPostNavSummary(wc)}` : `Back action completed but page stayed on ${afterUrl}`;
+          return afterUrl !== beforeUrl ? `Went back to ${afterUrl}${await getPostNavSummary(wc)}` : `Back action completed but page stayed on ${afterUrl}`;
         }
         case "go_forward": {
           if (!tab || !wc || !tabId) return "Error: No active tab";
@@ -10198,7 +10828,7 @@ async function executeAction(name, args, ctx) {
           ctx.tabManager.goForward(tabId);
           await waitForLoad$1(wc);
           const afterUrl = wc.getURL();
-          return afterUrl !== beforeUrl ? `Went forward to ${afterUrl}${getPostNavSummary(wc)}` : `Forward action completed but page stayed on ${afterUrl}`;
+          return afterUrl !== beforeUrl ? `Went forward to ${afterUrl}${await getPostNavSummary(wc)}` : `Forward action completed but page stayed on ${afterUrl}`;
         }
         case "reload": {
           if (!wc || !tabId) return "Error: No active tab";
@@ -10317,6 +10947,10 @@ async function executeAction(name, args, ctx) {
         }
         case "read_page": {
           if (!wc) return "Error: No active tab";
+          const requestedGlance = typeof args.mode === "string" && args.mode.trim().toLowerCase() === "glance";
+          if (requestedGlance) {
+            return glanceExtract(wc);
+          }
           console.log("[Vessel read_page] starting extraction with 6s timeout");
           let content = null;
           try {
@@ -10335,7 +10969,29 @@ async function executeAction(name, args, ctx) {
           console.log(
             `[Vessel read_page] extraction result: ${content ? `content=${content.content.length}` : "null (timeout)"}`
           );
-          if (content) {
+          if (!content || content.content.length === 0) {
+            console.log("[Vessel read_page] content empty/null, trying quick iframe dismiss");
+            try {
+              const iframeResult = await Promise.race([
+                tryDismissConsentIframe(wc),
+                new Promise((resolve) => setTimeout(() => resolve(null), 2e3))
+              ]);
+              if (iframeResult) {
+                console.log(`[Vessel read_page] iframe dismiss: ${iframeResult}`);
+                await sleep$1(500);
+                try {
+                  content = await Promise.race([
+                    extractContent(wc),
+                    new Promise((resolve) => setTimeout(() => resolve(null), 3e3))
+                  ]);
+                } catch {
+                  content = null;
+                }
+              }
+            } catch {
+            }
+          }
+          if (content && content.content.length > 0) {
             const liveSelectionSection = formatLiveSelectionSection(
               await captureLiveHighlightSnapshot(
                 wc,
@@ -10367,16 +11023,8 @@ ${truncated}`;
               `Need more detail? Escalate with read_page(mode="debug") only if the narrow modes are insufficient.`
             ].filter(Boolean).join("\n\n");
           }
-          const title = wc.getTitle() || "(untitled)";
-          const url = wc.getURL();
-          return [
-            `# ${title}`,
-            `URL: ${url}`,
-            "",
-            "[Page content extraction timed out — the page JS thread is busy.]",
-            "[Use the search tool to search the site, or type_text/click to interact directly.]",
-            "[You can retry read_page in a few seconds once the page finishes loading.]"
-          ].join("\n");
+          console.log("[Vessel read_page] falling back to glance mode");
+          return glanceExtract(wc);
         }
         case "wait_for": {
           if (!wc) return "Error: No active tab";
@@ -11078,6 +11726,7 @@ ${steps.join("\n")}`;
             try {
               const url = new URL(searchInfo.formAction);
               url.searchParams.set(searchInfo.inputName || "q", query);
+              assertSafeURL(url.toString());
               wc.loadURL(url.toString());
               await waitForPotentialNavigation$1(wc, beforeUrl);
               afterUrl = wc.getURL();
@@ -11147,9 +11796,20 @@ ${steps.join("\n")}`;
                 '[aria-label="Accept cookies"]',
                 '[aria-label="Accept all cookies"]',
                 '[data-testid="cookie-accept"]',
+                // CNN / WarnerMedia / common consent SDKs
+                '[data-testid="consent-accept"]',
+                '[data-testid="accept-all"]',
+                'button[class*="consent"][class*="accept"]',
+                'button[class*="privacy"][class*="accept"]',
+                '.fc-cta-consent',
+                '#sp_choice_button_accept',
+                '.message-component.message-button.no-children.focusable.sp_choice_type_11',
+                '[class*="truste"] [class*="accept"]',
+                '[id*="consent-accept"]',
+                '[class*="cmp-accept"]',
               ];
               // Also try text-matching on buttons
-              var textPatterns = ['accept all', 'accept cookies', 'allow all', 'allow cookies', 'agree', 'got it', 'ok', 'i agree', 'consent'];
+              var textPatterns = ['accept all', 'accept cookies', 'allow all', 'allow cookies', 'agree', 'got it', 'ok', 'i agree', 'i accept', 'consent', 'continue', 'accept and continue', 'accept & continue'];
               for (var i = 0; i < selectors.length; i++) {
                 var el = document.querySelector(selectors[i]);
                 if (el && el instanceof HTMLElement) { el.click(); return "Dismissed cookie banner via: " + selectors[i]; }
@@ -11175,7 +11835,10 @@ ${steps.join("\n")}`;
           if (dismissed === PAGE_SCRIPT_TIMEOUT) {
             return pageBusyError("accept_cookies");
           }
-          return dismissed || "No cookie consent banner detected. Try dismiss_popup for other overlays.";
+          if (dismissed) return dismissed;
+          const iframeResult = await tryDismissConsentIframe(wc);
+          if (iframeResult) return iframeResult;
+          return "No cookie consent banner detected. Try dismiss_popup for other overlays.";
         }
         case "extract_table": {
           if (!wc) return "Error: No active tab";
@@ -11273,10 +11936,10 @@ ${JSON.stringify(tableJson, null, 2)}`;
   const flowCtx = ctx.runtime.getFlowContext();
   return result + await getPostActionState$1(ctx, name) + flowCtx;
 }
-async function handleAIQuery(query, provider, activeWebContents, onChunk, onEnd, tabManager, runtime, history) {
+async function handleAIQuery(query, provider, activeWebContents, onChunk, onEnd, tabManager, runtime2, history) {
   const lowerQuery = query.toLowerCase().trim();
   const isSummarize = lowerQuery.startsWith("summarize") || lowerQuery.startsWith("tldr") || lowerQuery === "summary";
-  if (provider.streamAgentQuery && tabManager && activeWebContents && runtime) {
+  if (provider.streamAgentQuery && tabManager && activeWebContents && runtime2) {
     try {
       const extractStart = Date.now();
       const pageContent = await extractContent(activeWebContents);
@@ -11289,7 +11952,7 @@ async function handleAIQuery(query, provider, activeWebContents, onChunk, onEnd,
         pageContent,
         defaultReadMode
       );
-      const runtimeState = runtime.getState();
+      const runtimeState = runtime2.getState();
       const recentCheckpoints = runtimeState.checkpoints.slice(-3).map((item) => `- ${item.name} (${item.id})`).join("\n");
       const activeTabTitle = pageContent.title || "(untitled)";
       const activeTabUrl = pageContent.url || activeWebContents.getURL();
@@ -11332,8 +11995,10 @@ Instructions:
 - After navigating to a new site, DO NOT call read_page immediately. Instead, act on what you already know: use the search tool to search the site, type_text to enter queries in search bars, or click on known navigation patterns. You know what major sites look like — use that knowledge. Only call read_page if you're genuinely stuck and need to discover unfamiliar page structure.
 - The page brief you start with is intentionally sparse. It is optimized for navigation speed, not completeness.
 - When you only need detail on one product/result/card/form section, use inspect_element instead of reading the page.
-- Escalate page reads progressively: read_page(mode="visible_only"), read_page(mode="results_only"), read_page(mode="forms_only"), read_page(mode="summary"), or read_page(mode="text_only") depending on what you need.
+- Escalate page reads progressively: read_page(mode="glance") for a fast viewport snapshot on heavy/slow pages, then read_page(mode="visible_only"), read_page(mode="results_only"), read_page(mode="forms_only"), read_page(mode="summary"), or read_page(mode="text_only") depending on what you need.
+- Use read_page(mode="glance") when a page is slow to load or extraction times out — it shows what's on screen (headings, links, buttons, inputs) without waiting for heavy JS. It's what a human would see by just looking at the page.
 - Use read_page(mode="debug") only as a last resort when the narrower modes are insufficient.
+- If read_page returns empty or times out, do NOT retry with the same mode. Switch to read_page(mode="glance") or interact directly with click/type_text.
 - VIEWPORT SYNC: Treat scrolling as a real, user-visible browser action. If you say you are going to scroll, call scroll or scroll_to_element so the human sees the page move too.
 - read_page inspects the page without moving the human-visible viewport. Do not describe read_page as scrolling. If you want more context without changing the user's view, say you're reading the page; if you want the user to follow along lower on the page, actually scroll first.
 - After clicking or submitting a form, prefer wait_for on a specific result signal or a narrow read_page mode. Do not jump straight to read_page(mode="debug").
@@ -11351,7 +12016,7 @@ Instructions:
 - ACT, DON'T HEDGE: You have a full browser — you can navigate to any website, see live content, search, click, add to cart, fill forms, and interact with real pages in real time. Never claim you "don't have access" to a website's inventory, pricing, or content. If the user asks you to go somewhere and do something, start doing it immediately. Don't ask for permission to do what the user just asked you to do — that's redundant and frustrating. Jump straight into action.
 - USE YOUR KNOWLEDGE: You have broad, practical knowledge about technology, products, cooking, travel, finance, and countless other domains. When the user asks for recommendations, GIVE them — don't deflect to Reddit, YouTubers, or other sources. You know enough to recommend PC parts, suggest restaurants, pick a good laptop, or advise on most consumer decisions. Make a clear recommendation, explain your reasoning briefly, and then execute. If there's genuine ambiguity (e.g. AMD vs Intel is preference-dependent), state your pick and why, then ask only the questions that would actually change your recommendation. Never refuse a recommendation by claiming you're "not an expert" — the user chose to ask you, so help them.
 - NEVER USE EMOJIS unless the user uses them first.`;
-      const actionCtx = { tabManager, runtime };
+      const actionCtx = { tabManager, runtime: runtime2 };
       const contextualTools = pruneToolsForContext(
         AGENT_TOOLS,
         pageType,
@@ -11779,7 +12444,7 @@ function broadcastState(tabManager) {
   const tabId = tabManager.getActiveTabId();
   stateListener(getDevToolsPanelState(tabId));
 }
-async function withDevToolsAction(runtime, tabManager, name, args, executor) {
+async function withDevToolsAction(runtime2, tabManager, name, args, executor) {
   const activityEntry = {
     id: ++activityCounter,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -11796,7 +12461,7 @@ async function withDevToolsAction(runtime, tabManager, name, args, executor) {
   broadcastState(tabManager);
   const startTime = Date.now();
   try {
-    const result = await runtime.runControlledAction({
+    const result = await runtime2.runControlledAction({
       source: "mcp",
       name,
       args,
@@ -11818,7 +12483,7 @@ async function withDevToolsAction(runtime, tabManager, name, args, executor) {
     return asTextResponse$1(`Error: ${message}`);
   }
 }
-function registerDevTools(server, tabManager, runtime) {
+function registerDevTools(server, tabManager, runtime2) {
   server.registerTool(
     "vessel_devtools_console_logs",
     {
@@ -11830,16 +12495,16 @@ function registerDevTools(server, tabManager, runtime) {
         search: zod.z.string().optional().describe("Filter entries containing this text (case-insensitive)")
       }
     },
-    async ({ level, limit, search }) => {
+    async ({ level, limit, search: search2 }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_console_logs",
-        { level, limit, search },
+        { level, limit, search: search2 },
         async () => {
           const session = getOrCreateSession(tabManager);
           await session.ensureConsoleDomain();
-          const entries = session.getConsoleLogs({ level, limit, search });
+          const entries = session.getConsoleLogs({ level, limit, search: search2 });
           if (entries.length === 0) {
             return "No console entries captured yet. Console monitoring is now active — new entries will be captured as they occur.";
           }
@@ -11856,7 +12521,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async () => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_console_clear",
         {},
@@ -11883,7 +12548,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ url_pattern, method, status_min, status_max, limit }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_network_log",
         { url_pattern, method, status_min, status_max, limit },
@@ -11915,7 +12580,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ request_id }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_network_response_body",
         { request_id },
@@ -11941,7 +12606,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async () => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_network_clear",
         {},
@@ -11965,7 +12630,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ selector, include_html }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_query_dom",
         { selector, include_html },
@@ -11996,7 +12661,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ selector, properties }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_get_styles",
         { selector, properties },
@@ -12024,7 +12689,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ selector, attribute, value }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_modify_dom",
         { selector, attribute, value },
@@ -12046,7 +12711,7 @@ function registerDevTools(server, tabManager, runtime) {
     },
     async ({ expression }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_execute_js",
         { expression: expression.slice(0, 200) },
@@ -12074,7 +12739,7 @@ Exception: ${result.exceptionDetails}`);
     },
     async ({ type }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_get_storage",
         { type },
@@ -12103,7 +12768,7 @@ Exception: ${result.exceptionDetails}`);
     },
     async ({ type, key, value }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_set_storage",
         { type, key, value: value ? value.slice(0, 100) : null },
@@ -12122,7 +12787,7 @@ Exception: ${result.exceptionDetails}`);
     },
     async () => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_performance",
         {},
@@ -12146,7 +12811,7 @@ Exception: ${result.exceptionDetails}`);
     },
     async ({ type, limit }) => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_get_errors",
         { type, limit },
@@ -12170,7 +12835,7 @@ Exception: ${result.exceptionDetails}`);
     },
     async () => {
       return withDevToolsAction(
-        runtime,
+        runtime2,
         tabManager,
         "devtools_clear_errors",
         {},
@@ -12184,6 +12849,7 @@ Exception: ${result.exceptionDetails}`);
   );
 }
 let httpServer = null;
+let mcpAuthToken = null;
 function asTextResponse(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -13121,9 +13787,9 @@ async function getPostActionState(tabManager, name) {
   }
   return "";
 }
-async function withAction(runtime, tabManager, name, args, executor) {
+async function withAction(runtime2, tabManager, name, args, executor) {
   try {
-    const result = await runtime.runControlledAction({
+    const result = await runtime2.runControlledAction({
       source: "mcp",
       name,
       args,
@@ -13132,7 +13798,7 @@ async function withAction(runtime, tabManager, name, args, executor) {
       executor
     });
     const stateInfo = await getPostActionState(tabManager, name);
-    const flowCtx = runtime.getFlowContext();
+    const flowCtx = runtime2.getFlowContext();
     return asTextResponse(result + stateInfo + flowCtx);
   } catch (error) {
     return asTextResponse(
@@ -13426,6 +14092,7 @@ async function submitForm(wc, index, selector) {
     if (formInfo.params) {
       url.search = formInfo.params;
     }
+    assertSafeURL(url.toString());
     wc.loadURL(url.toString());
     await waitForPotentialNavigation(wc, beforeUrl);
     const afterUrl = wc.getURL();
@@ -13567,7 +14234,7 @@ async function captureScreenshotPayload(wc) {
   }
   return { ok: false, error: "page image was empty after 3 attempts" };
 }
-function registerTools(server, tabManager, runtime) {
+function registerTools(server, tabManager, runtime2) {
   server.registerPrompt(
     "vessel-supervisor-brief",
     {
@@ -13575,7 +14242,7 @@ function registerTools(server, tabManager, runtime) {
       description: "A reusable prompt for reviewing the current Vessel runtime state."
     },
     async () => {
-      const state2 = runtime.getState();
+      const state2 = runtime2.getState();
       const activeTab = getActiveTabSummary(tabManager);
       return asPromptResponse(
         [
@@ -13602,7 +14269,7 @@ function registerTools(server, tabManager, runtime) {
       contents: [
         {
           uri: "vessel://runtime/state",
-          text: JSON.stringify(runtime.getState(), null, 2)
+          text: JSON.stringify(runtime2.getState(), null, 2)
         }
       ]
     })
@@ -13718,7 +14385,7 @@ function registerTools(server, tabManager, runtime) {
       }
     },
     async ({ text, stream_id, mode, kind, title }) => {
-      const entry = runtime.publishTranscript({
+      const entry = runtime2.publishTranscript({
         source: "mcp",
         text,
         streamId: stream_id,
@@ -13748,7 +14415,7 @@ function registerTools(server, tabManager, runtime) {
       description: "Clear the in-browser transcript monitor state."
     },
     async () => {
-      runtime.clearTranscript();
+      runtime2.clearTranscript();
       return asTextResponse("Cleared browser transcript monitor.");
     }
   );
@@ -13888,7 +14555,7 @@ ${buildScopedContext(pageContent, mode)}`;
           `Navigation blocked: ${url} returned ${preCheck.detail || "dead link"}. Try a different URL or go back and choose another link.`
         );
       }
-      return withAction(runtime, tabManager, "navigate", { url }, async () => {
+      return withAction(runtime2, tabManager, "navigate", { url }, async () => {
         const id = tabManager.getActiveTabId();
         tabManager.navigateTab(id, url);
         const { httpStatus } = await waitForLoadWithStatus(
@@ -13918,7 +14585,7 @@ ${buildScopedContext(pageContent, mode)}`;
         return asTextResponse("Error: No active tab");
       }
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "set_ad_blocking",
         { enabled, tabId, match, reload },
@@ -14007,7 +14674,7 @@ ${buildScopedContext(pageContent, mode)}`;
     async () => {
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
-      return withAction(runtime, tabManager, "go_back", {}, async () => {
+      return withAction(runtime2, tabManager, "go_back", {}, async () => {
         if (!tab.canGoBack()) {
           return "No previous page in history";
         }
@@ -14028,7 +14695,7 @@ ${buildScopedContext(pageContent, mode)}`;
     async () => {
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
-      return withAction(runtime, tabManager, "go_forward", {}, async () => {
+      return withAction(runtime2, tabManager, "go_forward", {}, async () => {
         if (!tab.canGoForward()) {
           return "No forward page in history";
         }
@@ -14049,7 +14716,7 @@ ${buildScopedContext(pageContent, mode)}`;
     async () => {
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
-      return withAction(runtime, tabManager, "reload", {}, async () => {
+      return withAction(runtime2, tabManager, "reload", {}, async () => {
         tabManager.reloadTab(tabManager.getActiveTabId());
         await waitForLoad(tab.view.webContents);
         return `Reloaded ${tab.view.webContents.getURL()}`;
@@ -14070,7 +14737,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "click",
         { index, selector },
@@ -14099,7 +14766,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "hover",
         { index, selector },
@@ -14128,7 +14795,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "focus",
         { index, selector },
@@ -14242,7 +14909,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "type",
         { index, selector, text, mode },
@@ -14281,7 +14948,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "type_text",
         { index, selector, text, mode },
@@ -14318,7 +14985,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "select_option",
         { index, selector, label, value },
@@ -14340,7 +15007,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "submit_form",
         { index, selector },
@@ -14373,7 +15040,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "press_key",
         { key, index, selector },
@@ -14409,7 +15076,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "scroll",
         { direction, amount },
@@ -14432,7 +15099,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "dismiss_popup",
         {},
@@ -14455,7 +15122,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "clear_overlays",
         { strategy: strategy || "auto" },
@@ -14481,7 +15148,7 @@ ${buildScopedContext(pageContent, mode)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "wait_for",
         { text, selector, timeoutMs },
@@ -14498,7 +15165,7 @@ ${buildScopedContext(pageContent, mode)}`;
         url: zod.z.string().optional().describe("URL to open (defaults to about:blank)")
       }
     },
-    async ({ url }) => withAction(runtime, tabManager, "create_tab", { url }, async () => {
+    async ({ url }) => withAction(runtime2, tabManager, "create_tab", { url }, async () => {
       const id = tabManager.createTab(url || "about:blank");
       const tab = tabManager.getActiveTab();
       if (tab) {
@@ -14518,7 +15185,7 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ tabId, match }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "switch_tab",
       { tabId, match },
@@ -14541,7 +15208,7 @@ ${buildScopedContext(pageContent, mode)}`;
         tabId: zod.z.string().describe("The tab ID to close")
       }
     },
-    async ({ tabId }) => withAction(runtime, tabManager, "close_tab", { tabId }, async () => {
+    async ({ tabId }) => withAction(runtime2, tabManager, "close_tab", { tabId }, async () => {
       tabManager.closeTab(tabId);
       return `Closed tab ${tabId}`;
     })
@@ -14557,12 +15224,12 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ name, note }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "create_checkpoint",
       { name, note },
       async () => {
-        const checkpoint = runtime.createCheckpoint(name, note);
+        const checkpoint = runtime2.createCheckpoint(name, note);
         return `Created checkpoint ${checkpoint.name} (${checkpoint.id})`;
       }
     )
@@ -14578,12 +15245,12 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ name, note }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "create_checkpoint",
       { name, note },
       async () => {
-        const checkpoint = runtime.createCheckpoint(name, note);
+        const checkpoint = runtime2.createCheckpoint(name, note);
         return `Created checkpoint ${checkpoint.name} (${checkpoint.id})`;
       }
     )
@@ -14599,17 +15266,17 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ checkpointId, name }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "restore_checkpoint",
       { checkpointId, name },
       async () => {
-        const state2 = runtime.getState();
+        const state2 = runtime2.getState();
         const checkpoint = state2.checkpoints.find((item) => item.id === checkpointId) || state2.checkpoints.find((item) => item.name === name);
         if (!checkpoint) {
           return "Error: No matching checkpoint found";
         }
-        runtime.restoreCheckpoint(checkpoint.id);
+        runtime2.restoreCheckpoint(checkpoint.id);
         return `Restored checkpoint ${checkpoint.name}`;
       }
     )
@@ -14625,17 +15292,17 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ checkpointId, name }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "restore_checkpoint",
       { checkpointId, name },
       async () => {
-        const state2 = runtime.getState();
+        const state2 = runtime2.getState();
         const checkpoint = state2.checkpoints.find((item) => item.id === checkpointId) || state2.checkpoints.find((item) => item.name === name);
         if (!checkpoint) {
           return "Error: No matching checkpoint found";
         }
-        runtime.restoreCheckpoint(checkpoint.id);
+        runtime2.restoreCheckpoint(checkpoint.id);
         return `Restored checkpoint ${checkpoint.name}`;
       }
     )
@@ -14649,7 +15316,7 @@ ${buildScopedContext(pageContent, mode)}`;
         name: zod.z.string().describe("Session name such as github-logged-in")
       }
     },
-    async ({ name }) => withAction(runtime, tabManager, "save_session", { name }, async () => {
+    async ({ name }) => withAction(runtime2, tabManager, "save_session", { name }, async () => {
       const saved = await saveNamedSession(
         tabManager,
         name
@@ -14666,7 +15333,7 @@ ${buildScopedContext(pageContent, mode)}`;
         name: zod.z.string().describe("Previously saved session name")
       }
     },
-    async ({ name }) => withAction(runtime, tabManager, "load_session", { name }, async () => {
+    async ({ name }) => withAction(runtime2, tabManager, "load_session", { name }, async () => {
       const loaded = await loadNamedSession(
         tabManager,
         name
@@ -14680,7 +15347,7 @@ ${buildScopedContext(pageContent, mode)}`;
       title: "List Sessions",
       description: "List previously saved named browser sessions with cookie and storage counts."
     },
-    async () => withAction(runtime, tabManager, "list_sessions", {}, async () => {
+    async () => withAction(runtime2, tabManager, "list_sessions", {}, async () => {
       const sessions2 = listNamedSessions();
       if (sessions2.length === 0) return "No saved sessions";
       return sessions2.map(
@@ -14698,7 +15365,7 @@ ${buildScopedContext(pageContent, mode)}`;
       }
     },
     async ({ name }) => withAction(
-      runtime,
+      runtime2,
       tabManager,
       "delete_session",
       { name },
@@ -14785,7 +15452,7 @@ To analyze visually, call vision_analyze with image_url="${screenshotPath}"`
       if (!tab) return asTextResponse("Error: No active tab");
       const normalizedText = normalizeLooseString(text);
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "highlight",
         {
@@ -14834,7 +15501,7 @@ To analyze visually, call vision_analyze with image_url="${screenshotPath}"`
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "clear_highlights",
         {},
@@ -14859,7 +15526,7 @@ To analyze visually, call vision_analyze with image_url="${screenshotPath}"`
       }
     },
     async ({ url }) => {
-      const state2 = getState$1();
+      const state2 = getState$2();
       const activeTab = tabManager.getActiveTab();
       const activeUrl = activeTab ? normalizeUrl(activeTab.view.webContents.getURL()) : null;
       const activeSavedHighlights = activeUrl ? state2.highlights.filter((highlight) => highlight.url === activeUrl) : [];
@@ -14990,7 +15657,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ name, summary }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "create_bookmark_folder",
         { name, summary },
@@ -15052,7 +15719,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
       on_duplicate
     }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "save_bookmark",
         {
@@ -15131,7 +15798,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ folder_id, folder_name }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "list_bookmarks",
         { folder_id, folder_name },
@@ -15196,7 +15863,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async (args) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "organize_bookmark",
         args,
@@ -15263,7 +15930,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ query }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "search_bookmarks",
         { query },
@@ -15294,7 +15961,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ bookmark_id }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "remove_bookmark",
         { bookmark_id },
@@ -15327,7 +15994,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ bookmark_id, url, title, index, selector, note }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "archive_bookmark",
         { bookmark_id, url, title, index, selector, note },
@@ -15397,7 +16064,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ bookmark_id, new_tab }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "open_bookmark",
         { bookmark_id, new_tab },
@@ -15440,7 +16107,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ folder_id }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "remove_bookmark_folder",
         { folder_id },
@@ -15466,7 +16133,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ folder_id, new_name, summary }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "rename_bookmark_folder",
         { folder_id, new_name, summary },
@@ -15503,7 +16170,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ title, body, folder, tags }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_note_create",
         { title, folder, tags },
@@ -15527,7 +16194,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ note_path, content, heading }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_note_append",
         { note_path, heading },
@@ -15554,7 +16221,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ folder, limit }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_note_list",
         { folder, limit },
@@ -15584,7 +16251,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ query, folder, tags, limit }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_note_search",
         { query, folder, tags, limit },
@@ -15617,7 +16284,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_page_capture",
         { title, folder, tags },
@@ -15654,7 +16321,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     },
     async ({ bookmark_id, note_path, title, folder, note, tags }) => {
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "memory_link_bookmark",
         { bookmark_id, note_path, title, folder, tags },
@@ -15693,7 +16360,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
     async ({ goal, steps }) => {
       const normalizedSteps = coerceStringArray(steps) ?? [];
       const tab = tabManager.getActiveTab();
-      const flow = runtime.startFlow(
+      const flow = runtime2.startFlow(
         goal,
         normalizedSteps,
         tab?.view.webContents.getURL()
@@ -15714,9 +16381,9 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       }
     },
     async ({ detail }) => {
-      const flow = runtime.advanceFlow(detail);
+      const flow = runtime2.advanceFlow(detail);
       if (!flow) return asTextResponse("No active flow to advance");
-      const ctx = runtime.getFlowContext();
+      const ctx = runtime2.getFlowContext();
       return asTextResponse(`Step completed.${ctx}`);
     }
   );
@@ -15727,9 +16394,9 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       description: "Check the current workflow progress."
     },
     async () => {
-      const flow = runtime.getFlowState();
+      const flow = runtime2.getFlowState();
       if (!flow) return asTextResponse("No active workflow.");
-      return asTextResponse(runtime.getFlowContext());
+      return asTextResponse(runtime2.getFlowContext());
     }
   );
   server.registerTool(
@@ -15739,7 +16406,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       description: "Clear the active workflow tracker."
     },
     async () => {
-      runtime.clearFlow();
+      runtime2.clearFlow();
       return asTextResponse("Workflow ended.");
     }
   );
@@ -15768,7 +16435,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       suggestions.push(`Page: ${page.title || "(untitled)"}`);
       suggestions.push(`URL: ${page.url}`);
       suggestions.push("");
-      const flowCtx = runtime.getFlowContext();
+      const flowCtx = runtime2.getFlowContext();
       if (flowCtx) {
         suggestions.push(flowCtx);
         suggestions.push("");
@@ -15868,7 +16535,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "fill_form",
         { fieldCount: fields.length, submit },
@@ -15925,7 +16592,7 @@ ${results.join("\n")}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "login",
         { url, username: username.slice(0, 3) + "***" },
@@ -16030,7 +16697,7 @@ ${steps.join("\n")}`;
           `Error: "${query}" looks like a button label, not a search query. Use the click tool to interact with this element instead.`
         );
       }
-      return withAction(runtime, tabManager, "search", { query }, async () => {
+      return withAction(runtime2, tabManager, "search", { query }, async () => {
         const wc = tab.view.webContents;
         const searchSel = selector || await wc.executeJavaScript(`
               (function() {
@@ -16084,7 +16751,7 @@ ${steps.join("\n")}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "paginate",
         { direction },
@@ -16135,7 +16802,7 @@ ${steps.join("\n")}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "vessel_accept_cookies",
         {},
@@ -16193,7 +16860,7 @@ ${steps.join("\n")}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "vessel_extract_table",
         { index, selector: rawSelector },
@@ -16248,7 +16915,7 @@ ${JSON.stringify(tableJson, null, 2)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "vessel_scroll_to_element",
         { index, selector: rawSelector, position },
@@ -16306,7 +16973,7 @@ ${JSON.stringify(tableJson, null, 2)}`;
       const tab = tabManager.getActiveTab();
       if (!tab) return asTextResponse("Error: No active tab");
       return withAction(
-        runtime,
+        runtime2,
         tabManager,
         "vessel_wait_for_navigation",
         { timeoutMs },
@@ -16357,7 +17024,7 @@ ${JSON.stringify(tableJson, null, 2)}`;
       inputSchema: zod.z.object({})
     },
     async () => {
-      const m = runtime.getMetrics();
+      const m = runtime2.getMetrics();
       const lines = [
         `Session Metrics:`,
         `  Total actions: ${m.totalActions}`,
@@ -16517,16 +17184,16 @@ async function resolveSelector(wc, index, selector) {
     `
   );
 }
-function createMcpServer(tabManager, runtime) {
+function createMcpServer(tabManager, runtime2) {
   const server = new mcp_js.McpServer({
     name: "vessel-browser",
     version: "0.1.0"
   });
-  registerTools(server, tabManager, runtime);
-  registerDevTools(server, tabManager, runtime);
+  registerTools(server, tabManager, runtime2);
+  registerDevTools(server, tabManager, runtime2);
   return server;
 }
-function startMcpServer(tabManager, runtime, port) {
+function startMcpServer(tabManager, runtime2, port) {
   setMcpHealth({
     configuredPort: port,
     activePort: null,
@@ -16534,6 +17201,7 @@ function startMcpServer(tabManager, runtime, port) {
     status: "starting",
     message: `Starting MCP server on port ${port}.`
   });
+  mcpAuthToken = crypto$1.randomBytes(32).toString("hex");
   return new Promise((resolve) => {
     const server = http.createServer(async (req, res) => {
       const url = new URL(req.url || "/", `http://localhost:${port}`);
@@ -16542,22 +17210,28 @@ function startMcpServer(tabManager, runtime, port) {
         res.end("Not found");
         return;
       }
-      res.setHeader("Access-Control-Allow-Origin", "*");
+      res.setHeader("Access-Control-Allow-Origin", "null");
       res.setHeader(
         "Access-Control-Allow-Methods",
         "POST, GET, DELETE, OPTIONS"
       );
       res.setHeader(
         "Access-Control-Allow-Headers",
-        "Content-Type, mcp-session-id"
+        "Content-Type, mcp-session-id, Authorization"
       );
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
         return;
       }
+      const authHeader = req.headers.authorization;
+      if (!authHeader || authHeader !== `Bearer ${mcpAuthToken}`) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Unauthorized — missing or invalid bearer token" }));
+        return;
+      }
       try {
-        const mcpServer = createMcpServer(tabManager, runtime);
+        const mcpServer = createMcpServer(tabManager, runtime2);
         const transport = new streamableHttp_js.StreamableHTTPServerTransport({
           sessionIdGenerator: void 0
         });
@@ -16599,6 +17273,7 @@ function startMcpServer(tabManager, runtime, port) {
         configuredPort: port,
         activePort: null,
         endpoint: null,
+        authToken: null,
         error: message
       });
     });
@@ -16615,11 +17290,13 @@ function startMcpServer(tabManager, runtime, port) {
         message: `MCP server listening on ${endpoint}.`
       });
       console.log(`[Vessel MCP] Server listening on ${endpoint}`);
+      console.log(`[Vessel MCP] Auth token: ${mcpAuthToken}`);
       finish({
         ok: true,
         configuredPort: port,
         activePort: actualPort,
-        endpoint
+        endpoint,
+        authToken: mcpAuthToken
       });
     });
   });
@@ -16638,6 +17315,7 @@ function stopMcpServer() {
     }
     const server = httpServer;
     httpServer = null;
+    mcpAuthToken = null;
     server.close(() => {
       setMcpHealth({
         activePort: null,
@@ -16651,14 +17329,14 @@ function stopMcpServer() {
   });
 }
 let activeChatProvider = null;
-function registerIpcHandlers(windowState, runtime) {
+function registerIpcHandlers(windowState, runtime2) {
   const { tabManager, chromeView, sidebarView, devtoolsPanelView, mainWindow } = windowState;
   const sendToRendererViews = (channel, ...args) => {
     chromeView.webContents.send(channel, ...args);
     sidebarView.webContents.send(channel, ...args);
     devtoolsPanelView.webContents.send(channel, ...args);
   };
-  runtime.setUpdateListener((state2) => {
+  runtime2.setUpdateListener((state2) => {
     sendToRendererViews(Channels.AGENT_RUNTIME_UPDATE, state2);
   });
   electron.ipcMain.handle(Channels.TAB_CREATE, (_, url) => {
@@ -16708,7 +17386,7 @@ function registerIpcHandlers(windowState, runtime) {
         (chunk) => sendToRendererViews(Channels.AI_STREAM_CHUNK, chunk),
         () => sendToRendererViews(Channels.AI_STREAM_END),
         tabManager,
-        runtime,
+        runtime2,
         history
       );
     } catch (err) {
@@ -16791,46 +17469,50 @@ function registerIpcHandlers(windowState, runtime) {
   });
   electron.ipcMain.handle(Channels.SETTINGS_HEALTH_GET, () => getRuntimeHealth());
   electron.ipcMain.handle(Channels.SETTINGS_SET, async (_, key, value) => {
-    const updatedSettings = setSetting(key, value);
+    if (!SETTABLE_KEYS.has(key)) {
+      throw new Error(`Unknown setting key: ${key}`);
+    }
+    const settingsKey = key;
+    const updatedSettings = setSetting(settingsKey, value);
     if (key === "approvalMode") {
-      runtime.setApprovalMode(value);
+      runtime2.setApprovalMode(value);
     }
     if (key === "mcpPort") {
       await stopMcpServer();
-      await startMcpServer(tabManager, runtime, updatedSettings.mcpPort);
+      await startMcpServer(tabManager, runtime2, updatedSettings.mcpPort);
     }
     sendToRendererViews(Channels.SETTINGS_UPDATE, updatedSettings);
     return updatedSettings;
   });
-  electron.ipcMain.handle(Channels.AGENT_RUNTIME_GET, () => runtime.getState());
-  electron.ipcMain.handle(Channels.AGENT_PAUSE, () => runtime.pause());
-  electron.ipcMain.handle(Channels.AGENT_RESUME, () => runtime.resume());
+  electron.ipcMain.handle(Channels.AGENT_RUNTIME_GET, () => runtime2.getState());
+  electron.ipcMain.handle(Channels.AGENT_PAUSE, () => runtime2.pause());
+  electron.ipcMain.handle(Channels.AGENT_RESUME, () => runtime2.resume());
   electron.ipcMain.handle(
     Channels.AGENT_SET_APPROVAL_MODE,
     (_, mode) => {
       setSetting("approvalMode", mode);
-      return runtime.setApprovalMode(mode);
+      return runtime2.setApprovalMode(mode);
     }
   );
   electron.ipcMain.handle(
     Channels.AGENT_APPROVAL_RESOLVE,
-    (_, approvalId, approved) => runtime.resolveApproval(approvalId, approved)
+    (_, approvalId, approved) => runtime2.resolveApproval(approvalId, approved)
   );
   electron.ipcMain.handle(
     Channels.AGENT_CHECKPOINT_CREATE,
-    (_, name, note) => runtime.createCheckpoint(name, note)
+    (_, name, note) => runtime2.createCheckpoint(name, note)
   );
   electron.ipcMain.handle(
     Channels.AGENT_CHECKPOINT_RESTORE,
-    (_, checkpointId) => runtime.restoreCheckpoint(checkpointId)
+    (_, checkpointId) => runtime2.restoreCheckpoint(checkpointId)
   );
   electron.ipcMain.handle(
     Channels.AGENT_SESSION_CAPTURE,
-    (_, note) => runtime.captureSession(note)
+    (_, note) => runtime2.captureSession(note)
   );
   electron.ipcMain.handle(
     Channels.AGENT_SESSION_RESTORE,
-    (_, snapshot) => runtime.restoreSession(snapshot)
+    (_, snapshot) => runtime2.restoreSession(snapshot)
   );
   electron.ipcMain.handle(Channels.BOOKMARKS_GET, () => {
     return getState();
@@ -16864,36 +17546,12 @@ function registerIpcHandlers(windowState, runtime) {
         return { success: false, message: "No active tab" };
       }
       const wc = activeTab.view.webContents;
-      if (wc.isDestroyed()) {
-        return { success: false, message: "Tab is not available" };
-      }
-      const url = wc.getURL();
-      if (!url || url === "about:blank") {
-        return { success: false, message: "No page loaded" };
-      }
-      const selectedText = await wc.executeJavaScript(`
-        (function() {
-          var sel = window.getSelection();
-          return sel ? sel.toString().trim() : '';
-        })()
-      `);
-      if (!selectedText) {
-        return { success: false, message: "No text selected" };
+      const result = await captureSelectionHighlight(wc);
+      if (result.success && result.text) {
+        await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(() => {
+        });
       }
-      const capped = selectedText.length > 5e3 ? selectedText.slice(0, 5e3) : selectedText;
-      const highlight = addHighlight(
-        url,
-        void 0,
-        capped,
-        void 0,
-        "yellow",
-        "user"
-      );
-      await highlightOnPage(wc, null, capped, void 0, void 0, "yellow").catch(
-        () => {
-        }
-      );
-      return { success: true, text: capped, id: highlight.id };
+      return result;
     } catch {
       return { success: false, message: "Could not capture selection" };
     }
@@ -16909,24 +17567,11 @@ function registerIpcHandlers(windowState, runtime) {
       if (wc.isDestroyed()) return;
       const tab = tabManager.findTabByWebContentsId(wc.id);
       if (!tab || !tab.highlightModeActive) return;
-      const url = wc.getURL();
-      if (!url || url === "about:blank") return;
-      const capped = text.length > 5e3 ? text.slice(0, 5e3) : text;
-      const highlight = addHighlight(
-        url,
-        void 0,
-        capped,
-        void 0,
-        "yellow",
-        "user"
-      );
-      if (!chromeView.webContents.isDestroyed()) {
-        chromeView.webContents.send(Channels.HIGHLIGHT_CAPTURE_RESULT, {
-          success: true,
-          text: capped,
-          id: highlight.id
-        });
-      }
+      void persistAndMarkHighlight(wc, text).then((result) => {
+        if (result.success && !chromeView.webContents.isDestroyed()) {
+          chromeView.webContents.send(Channels.HIGHLIGHT_CAPTURE_RESULT, result);
+        }
+      });
     } catch {
     }
   });
@@ -16936,9 +17581,7 @@ function registerIpcHandlers(windowState, runtime) {
     const wc = tab.view.webContents;
     if (wc.isDestroyed()) return 0;
     try {
-      return wc.executeJavaScript(
-        `document.querySelectorAll('.__vessel-highlight, .__vessel-highlight-text').length`
-      );
+      return getHighlightCount(wc);
     } catch {
       return 0;
     }
@@ -16949,20 +17592,7 @@ function registerIpcHandlers(windowState, runtime) {
     const wc = tab.view.webContents;
     if (wc.isDestroyed()) return false;
     try {
-      return wc.executeJavaScript(`
-        (function() {
-          var highlights = document.querySelectorAll('.__vessel-highlight, .__vessel-highlight-text');
-          if (${index} < 0 || ${index} >= highlights.length) return false;
-          // Remove focus ring from all highlights
-          highlights.forEach(function(h) { h.style.removeProperty('outline'); h.style.removeProperty('outline-offset'); });
-          var target = highlights[${index}];
-          target.scrollIntoView({ behavior: 'smooth', block: 'center' });
-          // Add focus ring to current highlight
-          target.style.setProperty('outline', '2px solid rgba(255, 255, 255, 0.9)', 'important');
-          target.style.setProperty('outline-offset', '2px', 'important');
-          return true;
-        })()
-      `);
+      return scrollToHighlight(wc, index);
     } catch {
       return false;
     }
@@ -16973,32 +17603,7 @@ function registerIpcHandlers(windowState, runtime) {
     const wc = tab.view.webContents;
     if (wc.isDestroyed()) return false;
     try {
-      return wc.executeJavaScript(`
-        (function() {
-          var highlights = document.querySelectorAll('.__vessel-highlight, .__vessel-highlight-text');
-          if (${index} < 0 || ${index} >= highlights.length) return false;
-          var el = highlights[${index}];
-          // Remove associated label if any
-          document.querySelectorAll('.__vessel-highlight-label[data-vessel-highlight]').forEach(function(b) {
-            if (b.__vesselAnchor === el) b.remove();
-          });
-          // Unwrap text highlights, remove class from element highlights
-          if (el.tagName === 'MARK' && el.classList.contains('__vessel-highlight-text')) {
-            var parent = el.parentNode;
-            while (el.firstChild) parent.insertBefore(el.firstChild, el);
-            parent.removeChild(el);
-            parent.normalize();
-          } else {
-            el.classList.remove('__vessel-highlight');
-            el.style.removeProperty('background');
-            el.style.removeProperty('outline-color');
-            el.style.removeProperty('box-shadow');
-            el.style.removeProperty('outline');
-            el.style.removeProperty('outline-offset');
-          }
-          return true;
-        })()
-      `);
+      return removeHighlightAtIndex(wc, index);
     } catch {
       return false;
     }
@@ -17009,39 +17614,65 @@ function registerIpcHandlers(windowState, runtime) {
     const wc = tab.view.webContents;
     if (wc.isDestroyed()) return false;
     try {
-      return wc.executeJavaScript(`
-        (function() {
-          // Remove all labels
-          document.querySelectorAll('.__vessel-highlight-label[data-vessel-highlight]').forEach(function(b) { b.remove(); });
-          // Unwrap text highlights
-          document.querySelectorAll('.__vessel-highlight-text').forEach(function(mark) {
-            var parent = mark.parentNode;
-            while (mark.firstChild) parent.insertBefore(mark.firstChild, mark);
-            parent.removeChild(mark);
-            parent.normalize();
-          });
-          // Remove element highlights
-          document.querySelectorAll('.__vessel-highlight').forEach(function(el) {
-            el.classList.remove('__vessel-highlight');
-            el.style.removeProperty('background');
-            el.style.removeProperty('outline-color');
-            el.style.removeProperty('box-shadow');
-            el.style.removeProperty('outline');
-            el.style.removeProperty('outline-offset');
-          });
-          return true;
-        })()
-      `);
+      return clearAllHighlightElements(wc);
     } catch {
       return false;
     }
   });
+  let findWiredWcId = null;
+  function wireFindEvents(wc) {
+    if (findWiredWcId === wc.id) return;
+    if (findWiredWcId !== null) {
+      const prev = tabManager.findTabByWebContentsId(findWiredWcId);
+      if (prev) prev.view.webContents.removeAllListeners("found-in-page");
+    }
+    findWiredWcId = wc.id;
+    wc.on("found-in-page", (_event, result) => {
+      if (!chromeView.webContents.isDestroyed()) {
+        chromeView.webContents.send(Channels.FIND_IN_PAGE_RESULT, result);
+      }
+    });
+  }
+  electron.ipcMain.handle(Channels.FIND_IN_PAGE_START, (_, text, options) => {
+    const tab = tabManager.getActiveTab();
+    if (!tab) return null;
+    const wc = tab.view.webContents;
+    if (wc.isDestroyed()) return null;
+    wireFindEvents(wc);
+    return wc.findInPage(text, {
+      forward: options?.forward ?? true,
+      findNext: options?.findNext ?? false
+    });
+  });
+  electron.ipcMain.handle(Channels.FIND_IN_PAGE_NEXT, (_, forward) => {
+    const tab = tabManager.getActiveTab();
+    if (!tab) return null;
+    const wc = tab.view.webContents;
+    if (wc.isDestroyed()) return null;
+    return wc.findInPage("", { forward: forward ?? true, findNext: true });
+  });
+  electron.ipcMain.handle(Channels.FIND_IN_PAGE_STOP, (_, action) => {
+    const tab = tabManager.getActiveTab();
+    if (!tab) return;
+    const wc = tab.view.webContents;
+    if (wc.isDestroyed()) return;
+    wc.stopFindInPage(action ?? "clearSelection");
+  });
+  electron.ipcMain.handle(Channels.HISTORY_GET, () => {
+    return getState$1();
+  });
+  electron.ipcMain.handle(Channels.HISTORY_SEARCH, (_, query) => {
+    return search(query);
+  });
+  electron.ipcMain.handle(Channels.HISTORY_CLEAR, () => {
+    clearAll$1();
+  });
   electron.ipcMain.handle(Channels.DEVTOOLS_PANEL_TOGGLE, () => {
     windowState.uiState.devtoolsPanelOpen = !windowState.uiState.devtoolsPanelOpen;
     layoutViews(windowState);
     return { open: windowState.uiState.devtoolsPanelOpen };
   });
-  electron.ipcMain.handle("devtools-panel:resize", (_, height) => {
+  electron.ipcMain.handle(Channels.DEVTOOLS_PANEL_RESIZE, (_, height) => {
     const clamped = Math.max(MIN_DEVTOOLS_PANEL, Math.min(MAX_DEVTOOLS_PANEL, Math.round(height)));
     windowState.uiState.devtoolsPanelHeight = clamped;
     layoutViews(windowState);
@@ -17062,6 +17693,7 @@ function registerIpcHandlers(windowState, runtime) {
   });
 }
 const MAX_TRANSCRIPT_TEXT_LENGTH = 8e3;
+const PERSIST_DEBOUNCE_MS = 500;
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
@@ -17139,7 +17771,7 @@ class AgentRuntime {
   createCheckpoint(name, note) {
     const snapshot = this.captureSession(note);
     const checkpoint = {
-      id: node_crypto.randomUUID(),
+      id: crypto$1.randomUUID(),
       name: name?.trim() || `Checkpoint ${this.state.checkpoints.length + 1}`,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       note: note?.trim() || void 0,
@@ -17193,7 +17825,7 @@ class AgentRuntime {
       }
     }
     const entry = {
-      id: node_crypto.randomUUID(),
+      id: crypto$1.randomUUID(),
       source: input.source,
       kind,
       title: input.title?.trim() || void 0,
@@ -17217,7 +17849,7 @@ class AgentRuntime {
   // --- Speedee Flow State ---
   startFlow(goal, steps, startUrl) {
     const flow = {
-      id: node_crypto.randomUUID(),
+      id: crypto$1.randomUUID(),
       goal,
       steps: steps.map((label) => ({ label, status: "pending" })),
       currentStepIndex: 0,
@@ -17403,7 +18035,14 @@ ${progress}
       return sanitizePersistence(null);
     }
   }
-  persist() {
+  persistTimer = null;
+  persistDirty = false;
+  persistNow() {
+    this.persistDirty = false;
+    if (this.persistTimer) {
+      clearTimeout(this.persistTimer);
+      this.persistTimer = null;
+    }
     const persisted = {
       session: this.state.session,
       supervisor: {
@@ -17414,20 +18053,36 @@ ${progress}
       actions: this.state.actions.slice(-120),
       checkpoints: this.state.checkpoints.slice(-20)
     };
-    fs$1.mkdirSync(path$1.dirname(getRuntimeStatePath()), { recursive: true });
-    fs$1.writeFileSync(
-      getRuntimeStatePath(),
-      JSON.stringify(persisted, null, 2),
-      "utf-8"
-    );
+    try {
+      fs$1.mkdirSync(path$1.dirname(getRuntimeStatePath()), { recursive: true });
+      fs$1.writeFileSync(
+        getRuntimeStatePath(),
+        JSON.stringify(persisted, null, 2),
+        "utf-8"
+      );
+    } catch (err) {
+      console.error("[Vessel] Failed to persist runtime state:", err);
+    }
+  }
+  schedulePersist() {
+    this.persistDirty = true;
+    if (this.persistTimer) return;
+    this.persistTimer = setTimeout(() => {
+      this.persistTimer = null;
+      if (this.persistDirty) this.persistNow();
+    }, PERSIST_DEBOUNCE_MS);
+  }
+  /** Flush any pending debounced persist to disk immediately. Call on shutdown. */
+  flushPersist() {
+    if (this.persistDirty) this.persistNow();
   }
   emit() {
-    this.persist();
+    this.schedulePersist();
     this.updateListener?.(this.getState());
   }
   startAction(input) {
     const action = {
-      id: node_crypto.randomUUID(),
+      id: crypto$1.randomUUID(),
       source: input.source,
       name: input.name,
       args: clone(input.args),
@@ -17461,7 +18116,7 @@ ${progress}
   /** Aggregate metrics for all completed actions in this session. */
   getMetrics() {
     const completed = this.state.actions.filter((a) => a.status === "completed");
-    const failed = this.state.actions.filter((a) => a.status === "error");
+    const failed = this.state.actions.filter((a) => a.status === "failed");
     const durations = completed.filter((a) => a.durationMs != null).map((a) => a.durationMs);
     const avgDuration = durations.length > 0 ? durations.reduce((s, d) => s + d, 0) / durations.length : 0;
     const toolBreakdown = {};
@@ -17499,7 +18154,7 @@ ${progress}
   }
   awaitApproval(action, reason) {
     const approval = {
-      id: node_crypto.randomUUID(),
+      id: crypto$1.randomUUID(),
       actionId: action.id,
       source: action.source,
       name: action.name,
@@ -17625,6 +18280,41 @@ function installAdBlocking(tabManager) {
     callback({ cancel: shouldBlockRequest(details) });
   });
 }
+function installDownloadHandler(chromeView) {
+  electron.session.defaultSession.on("will-download", (_event, item) => {
+    const settings2 = loadSettings();
+    const downloadDir = settings2.downloadPath.trim() || electron.app.getPath("downloads");
+    const filename = item.getFilename();
+    const savePath = path.join(downloadDir, filename);
+    item.setSavePath(savePath);
+    const info = {
+      filename,
+      savePath,
+      totalBytes: item.getTotalBytes(),
+      receivedBytes: 0,
+      state: "progressing"
+    };
+    if (!chromeView.webContents.isDestroyed()) {
+      chromeView.webContents.send(Channels.DOWNLOAD_STARTED, info);
+    }
+    item.on("updated", (_event2, state2) => {
+      info.receivedBytes = item.getReceivedBytes();
+      info.totalBytes = item.getTotalBytes();
+      info.state = state2 === "progressing" ? "progressing" : "interrupted";
+      if (!chromeView.webContents.isDestroyed()) {
+        chromeView.webContents.send(Channels.DOWNLOAD_PROGRESS, info);
+      }
+    });
+    item.once("done", (_event2, state2) => {
+      info.receivedBytes = item.getReceivedBytes();
+      info.state = state2 === "completed" ? "completed" : "cancelled";
+      if (!chromeView.webContents.isDestroyed()) {
+        chromeView.webContents.send(Channels.DOWNLOAD_DONE, info);
+      }
+    });
+  });
+}
+let runtime = null;
 function rendererUrlFor(view) {
   if (!process.env.ELECTRON_RENDERER_URL) return null;
   const url = new URL(process.env.ELECTRON_RENDERER_URL);
@@ -17705,7 +18395,6 @@ async function bootstrap() {
   if (settings2.clearBookmarksOnLaunch) {
     clearAll();
   }
-  let runtime = null;
   const windowState = createMainWindow((tabs, activeId) => {
     windowState.chromeView.webContents.send(
       Channels.TAB_STATE_UPDATE,
@@ -17727,15 +18416,10 @@ async function bootstrap() {
   const registerHighlightShortcut = () => {
     electron.globalShortcut.unregister("CommandOrControl+H");
     const success = electron.globalShortcut.register("CommandOrControl+H", () => {
-      console.log("[Vessel] Ctrl+H shortcut triggered");
       const activeTab = tabManager.getActiveTab();
-      if (!activeTab) {
-        console.log("[Vessel] No active tab");
-        return;
-      }
+      if (!activeTab) return;
       tabManager.captureHighlightFromActiveTab();
     });
-    console.log("[Vessel] Ctrl+H shortcut registered:", success);
     if (!success) {
       console.warn("[Vessel] Failed to register Ctrl+H shortcut");
     }
@@ -17761,6 +18445,11 @@ async function bootstrap() {
     chromeView.webContents.send(Channels.BOOKMARKS_UPDATE, state2);
     sidebarView.webContents.send(Channels.BOOKMARKS_UPDATE, state2);
   });
+  subscribe$1((state2) => {
+    chromeView.webContents.send(Channels.HISTORY_UPDATE, state2);
+    sidebarView.webContents.send(Channels.HISTORY_UPDATE, state2);
+  });
+  installDownloadHandler(chromeView);
   const chromeUrl = rendererUrlFor("chrome");
   const sidebarUrl = rendererUrlFor("sidebar");
   const devtoolsUrl = rendererUrlFor("devtools");
@@ -17800,6 +18489,7 @@ electron.app.whenReady().then(bootstrap).catch((error) => {
 });
 electron.app.on("window-all-closed", () => {
   electron.globalShortcut.unregisterAll();
+  runtime?.flushPersist();
   void stopMcpServer().finally(() => {
     electron.app.quit();
   });