@quanta-intellect/vessel-browser 0.1.153 → 0.1.157

package/out/main/index.js

@@ -227,7 +227,14 @@ const SAVE_DEBOUNCE_MS$4 = 150;
 const CHAT_PROVIDER_SECRET_FILENAME = "vessel-chat-provider-secret";
 const CODEX_TOKENS_FILENAME = "vessel-codex-tokens";
 const logger$C = createLogger("Settings");
-const SETTABLE_KEYS = new Set(Object.keys(defaults));
+const INTERNAL_SETTING_KEYS = /* @__PURE__ */ new Set([
+  "premium"
+]);
+const RENDERER_SETTABLE_KEYS = new Set(
+  Object.keys(defaults).filter(
+    (key2) => !INTERNAL_SETTING_KEYS.has(key2)
+  )
+);
 const SettingsValueSchemas = {
   defaultUrl: zod.z.string().url(),
   theme: zod.z.enum(["dark", "light"]),
@@ -8084,6 +8091,22 @@ function shouldBlockOffGoalDomainNavigation(goal, targetUrl) {
 function hasRecentDuplicateToolCall(recentToolSignatures, signature) {
   return recentToolSignatures.includes(signature);
 }
+const DUPLICATE_TOOL_CALL_RETRYABLE_TOOLS = /* @__PURE__ */ new Set([
+  "read_page",
+  "current_tab",
+  "inspect_element",
+  "screenshot",
+  "go_back",
+  "go_forward",
+  "click"
+]);
+const REPEATED_TOOL_CALL_NUDGE = `[System] You are stuck repeating the same action. Stop repeating navigate/search. Use a different supported tool that advances the task, such as click, read_page, or scroll.`;
+function shouldSuppressDuplicateToolCall(recentToolSignatures, toolName, signature) {
+  return !DUPLICATE_TOOL_CALL_RETRYABLE_TOOLS.has(toolName) && hasRecentDuplicateToolCall(recentToolSignatures, signature);
+}
+function buildRepeatedToolCallError(toolName) {
+  return `Error: Repeated the same tool call (${toolName}) with the same arguments twice in a row. Do not repeat it. Continue with the next logical step for the original task.`;
+}
 function isClickReadLoop(names) {
   if (names.length < 6) return false;
   const tail = names.slice(-6);
@@ -10089,17 +10112,9 @@ class OpenAICompatProvider {
             compactCorrectionCount += 1;
             continue;
           }
-          const neverSuppressDuplicate = [
-            "read_page",
-            "current_tab",
-            "inspect_element",
-            "screenshot",
-            "go_back",
-            "go_forward",
-            "click"
-          ].includes(tc.name);
-          if (this.agentToolProfile === "compact" && !neverSuppressDuplicate && hasRecentDuplicateToolCall(
+          if (this.agentToolProfile === "compact" && shouldSuppressDuplicateToolCall(
             recentCompactToolSignatures,
+            tc.name,
             toolSignature
           )) {
             onChunk(`
@@ -10108,13 +10123,13 @@ class OpenAICompatProvider {
             messages.push({
               role: "tool",
               tool_call_id: tc.id,
-              content: `Error: Repeated the same tool call (${tc.name}) with the same arguments twice in a row. Do not repeat it. Continue with the next logical step for the original task.`
+              content: buildRepeatedToolCallError(tc.name)
             });
             compactCorrectionCount += 1;
             if (compactCorrectionCount >= 2) {
               messages.push({
                 role: "user",
-                content: `[System] You are stuck repeating the same action. Stop repeating navigate/search. Use a different supported tool that advances the task, such as click, read_page, or scroll.`
+                content: REPEATED_TOOL_CALL_NUDGE
               });
             }
             continue;
@@ -11228,21 +11243,17 @@ ${latestToolResultPreview || ""}`
             correctionCount += 1;
             continue;
           }
-          if (![
-            "read_page",
-            "current_tab",
-            "inspect_element",
-            "screenshot",
-            "go_back",
-            "go_forward",
-            "click"
-          ].includes(prepared.prepared.name) && hasRecentDuplicateToolCall(recentToolSignatures, toolSignature)) {
+          if (shouldSuppressDuplicateToolCall(
+            recentToolSignatures,
+            prepared.prepared.name,
+            toolSignature
+          )) {
             onChunk(`
 <<tool:${prepared.prepared.name}:↻ duplicate suppressed>>
 `);
             const output2 = createCodexToolOutput(
               prepared.prepared.callId,
-              `Error: Repeated the same tool call (${prepared.prepared.name}) with the same arguments twice in a row. Do not repeat it. Continue with the next logical step for the original task.`
+              buildRepeatedToolCallError(prepared.prepared.name)
             );
             currentInput.push(output2);
             latestToolResultPreview = previewToolResult(output2.output);
@@ -12977,6 +12988,166 @@ function getUrlPathSegments(value) {
     return value.split("?")[0].split("#")[0].split("/").filter(Boolean);
   }
 }
+const SITE_RESULT_FILTERS = [
+  {
+    hostname: "news.ycombinator.com",
+    listingPaths: [
+      "/",
+      "/news",
+      "/newest",
+      "/front",
+      "/ask",
+      "/show",
+      "/jobs",
+      "/best",
+      "/active",
+      "/classic",
+      "/noobstories"
+    ],
+    utilityPathnames: ["/hide", "/user"],
+    utilityTextPatterns: [
+      /^(hide|past|favorite|unfavorite|flag|unflag|discuss|reply|parent|more)$/,
+      /^\d+\s+(?:comments?|points?)$/
+    ]
+  }
+];
+function matchesSiteFilter(url, filter, baseHostname) {
+  try {
+    const parsed = new URL(url, baseHostname ? `https://${baseHostname}` : void 0);
+    return parsed.hostname === filter.hostname;
+  } catch {
+    return false;
+  }
+}
+function isSiteListingPage(url) {
+  for (const filter of SITE_RESULT_FILTERS) {
+    if (!matchesSiteFilter(url, filter, "")) continue;
+    try {
+      const pathname = new URL(url).pathname.replace(/\/+$/, "") || "/";
+      if (filter.listingPaths?.includes(pathname)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function isSiteUtilityLink(element) {
+  if (!element.href) return false;
+  for (const filter of SITE_RESULT_FILTERS) {
+    if (!matchesSiteFilter(element.href, filter, "")) continue;
+    const text = normalizeComparable(element.text || "");
+    for (const pattern of filter.utilityTextPatterns ?? []) {
+      if (pattern.test(text)) return true;
+    }
+    try {
+      const pathname = new URL(element.href).pathname.replace(/\/+$/, "") || "/";
+      if (filter.utilityPathnames?.includes(pathname)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function isSearchOrListingPage(page) {
+  if (isSiteListingPage(page.url)) return true;
+  const haystack = normalizeComparable(
+    [page.url, page.title, page.excerpt, page.headings.map((heading) => heading.text).join(" ")].filter(Boolean).join(" ")
+  );
+  return /\b(search|results|find|discover|browse|repositories|repository|issues|pull requests|prs|users|events|listings)\b/.test(
+    haystack
+  );
+}
+function collectJsonLdEntityItems(input, results = []) {
+  if (!input) return results;
+  if (Array.isArray(input)) {
+    input.forEach((item2) => collectJsonLdEntityItems(item2, results));
+    return results;
+  }
+  if (typeof input !== "object") return results;
+  const item = input;
+  const type = item["@type"];
+  const types = Array.isArray(type) ? type : [type];
+  const typeNames = types.filter((entry) => typeof entry === "string");
+  if ((typeof item.name === "string" || typeof item.url === "string") && !typeNames.some(
+    (entry) => ["BreadcrumbList", "Organization", "WebSite", "WebPage"].includes(entry)
+  )) {
+    results.push(item);
+  }
+  collectJsonLdEntityItems(item["@graph"], results);
+  collectJsonLdEntityItems(item.mainEntity, results);
+  collectJsonLdEntityItems(item.itemListElement, results);
+  collectJsonLdEntityItems(item.item, results);
+  return results;
+}
+function getResultCandidates(page) {
+  const entityItems = collectJsonLdEntityItems(page.jsonLd ?? []);
+  const entityNames = new Set(
+    entityItems.map((item) => typeof item.name === "string" ? normalizeComparable(item.name) : "").filter(Boolean)
+  );
+  const entityUrls = new Set(
+    entityItems.map((item) => typeof item.url === "string" ? normalizeUrlForMatch(item.url) : null).filter((value) => Boolean(value))
+  );
+  const pageHost = normalizeUrlForMatch(page.url);
+  const searchOrListingPage = isSearchOrListingPage(page);
+  const scored = page.interactiveElements.filter(
+    (element) => element.type === "link" && element.text?.trim() && element.href && !isSiteUtilityLink(element)
+  ).map((element) => {
+    const text = element.text?.trim() || "";
+    const comparableText = normalizeComparable(text);
+    const href = normalizeUrlForMatch(element.href);
+    const haystack = normalizeComparable(
+      [element.text, element.description, element.selector, element.href].filter(Boolean).join(" ")
+    );
+    let score = 0;
+    if (entityNames.has(comparableText)) score += 6;
+    if (href && entityUrls.has(href)) score += 6;
+    if (entityItems.some((item) => {
+      const name = typeof item.name === "string" ? normalizeComparable(item.name) : "";
+      return Boolean(name) && (name.includes(comparableText) || comparableText.includes(name));
+    })) {
+      score += 4;
+    }
+    if (element.context === "article") score += 3;
+    else if (element.context === "main" || element.context === "content") score += 1;
+    if (href && pageHost) {
+      try {
+        if (new URL(href).origin === new URL(pageHost).origin) score += 1;
+      } catch {
+      }
+    }
+    const hrefSegments = getUrlPathSegments(element.href);
+    if (hrefSegments.length >= 2) score += 1;
+    if (text.includes("/")) score += 1;
+    if (searchOrListingPage && (element.context === "article" || element.context === "main" || element.context === "content")) {
+      score += 2;
+    }
+    if (/\b(card|tile|result|rating|review)\b/.test(haystack)) score += 1;
+    if (/\b(item|list|row|repo|repository|issue|pull request|event)\b/.test(haystack)) {
+      score += 1;
+    }
+    if (text.length >= 12 && text.split(/\s+/).length >= 2) score += 1;
+    if (element.context === "nav" || element.context === "header" || element.context === "footer" || element.context === "sidebar" || element.context === "dialog") {
+      score -= 5;
+    }
+    if (/\b(home|menu|about|contact|privacy|terms|login|sign in|sign up|subscribe|newsletter|facebook|instagram|pinterest|share|print|next|previous|prev|sort|filter|star|sponsor)\b/.test(
+      comparableText
+    )) {
+      score -= 4;
+    }
+    return { element, score };
+  }).filter(({ score, element }) => {
+    if (entityItems.length > 0) return score >= 4;
+    if (searchOrListingPage) {
+      return score >= 4 || score >= 3 && (element.context === "article" || element.context === "main" || element.context === "content");
+    }
+    return score >= 4 || score >= 3 && element.context === "article";
+  }).sort((a, b) => b.score - a.score || (a.element.index ?? 0) - (b.element.index ?? 0));
+  const seen = /* @__PURE__ */ new Set();
+  return scored.map(({ element }) => element).filter((element) => {
+    const key2 = `${normalizeComparable(element.text || "")}|${normalizeUrlForMatch(element.href) || ""}`;
+    if (seen.has(key2)) return false;
+    seen.add(key2);
+    return true;
+  });
+}
 const MAX_STRUCTURED_ITEMS = 100;
 const LARGE_PAGE_HINT_THRESHOLD = 12e3;
 function truncateContent(content) {
@@ -13729,189 +13900,29 @@ const PAGE_TYPE_READ_MODE = {
   ARTICLE: "summary",
   GENERAL: "visible_only"
 };
-const SITE_RESULT_FILTERS = [
-  {
-    hostname: "news.ycombinator.com",
-    listingPaths: [
-      "/",
-      "/news",
-      "/newest",
-      "/front",
-      "/ask",
-      "/show",
-      "/jobs",
-      "/best",
-      "/active",
-      "/classic",
-      "/noobstories"
-    ],
-    utilityPathnames: ["/hide", "/user"],
-    utilityTextPatterns: [
-      /^(hide|past|favorite|unfavorite|flag|unflag|discuss|reply|parent|more)$/,
-      /^\d+\s+(?:comments?|points?)$/
-    ]
-  }
-];
-function matchesSiteFilter(url, filter, baseHostname) {
-  try {
-    const parsed = new URL(url, baseHostname ? `https://${baseHostname}` : void 0);
-    return parsed.hostname === filter.hostname;
-  } catch {
-    return false;
-  }
+function buildScopedContext(page, mode) {
+  const render = SCOPED_CONTEXT_RENDERERS.get(mode) ?? buildStructuredContext;
+  return render(page);
 }
-function isSiteListingPage(url) {
-  for (const filter of SITE_RESULT_FILTERS) {
-    if (!matchesSiteFilter(url, filter, "")) continue;
-    try {
-      const pathname = new URL(url).pathname.replace(/\/+$/, "") || "/";
-      if (filter.listingPaths?.includes(pathname)) return true;
-    } catch {
-    }
+function buildSummaryContext(page) {
+  const sections = [];
+  const cartSnapshot = formatCartSnapshot(page);
+  sections.push(`**URL:** ${page.url}`);
+  sections.push(`**Title:** ${page.title}`);
+  sections.push(`**Viewport:** ${formatViewport(page)}`);
+  if (page.byline) sections.push(`**Author:** ${page.byline}`);
+  if (page.excerpt) sections.push(`**Summary:** ${page.excerpt}`);
+  const largePageHint = formatLargePageHint(page);
+  if (largePageHint) sections.push(`**Reading Hint:** ${largePageHint}`);
+  const scrollHints = getScrollHints(page);
+  if (scrollHints.length > 0) {
+    sections.push(`**Scroll Hint:** ${scrollHints[0]}`);
   }
-  return false;
-}
-function isSiteUtilityLink(element) {
-  if (!element.href) return false;
-  for (const filter of SITE_RESULT_FILTERS) {
-    if (!matchesSiteFilter(element.href, filter, "")) continue;
-    const text = normalizeComparable(element.text || "");
-    for (const pattern of filter.utilityTextPatterns ?? []) {
-      if (pattern.test(text)) return true;
-    }
-    try {
-      const pathname = new URL(element.href).pathname.replace(/\/+$/, "") || "/";
-      if (filter.utilityPathnames?.includes(pathname)) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function isSearchOrListingPage(page) {
-  if (isSiteListingPage(page.url)) return true;
-  const haystack = normalizeComparable(
-    [page.url, page.title, page.excerpt, page.headings.map((heading) => heading.text).join(" ")].filter(Boolean).join(" ")
-  );
-  return /\b(search|results|find|discover|browse|repositories|repository|issues|pull requests|prs|users|events|listings)\b/.test(
-    haystack
-  );
-}
-function collectJsonLdEntityItems(input, results = []) {
-  if (!input) return results;
-  if (Array.isArray(input)) {
-    input.forEach((item2) => collectJsonLdEntityItems(item2, results));
-    return results;
-  }
-  if (typeof input !== "object") return results;
-  const item = input;
-  const type = item["@type"];
-  const types = Array.isArray(type) ? type : [type];
-  const typeNames = types.filter((entry) => typeof entry === "string");
-  if ((typeof item.name === "string" || typeof item.url === "string") && !typeNames.some(
-    (entry) => ["BreadcrumbList", "Organization", "WebSite", "WebPage"].includes(entry)
-  )) {
-    results.push(item);
-  }
-  collectJsonLdEntityItems(item["@graph"], results);
-  collectJsonLdEntityItems(item.mainEntity, results);
-  collectJsonLdEntityItems(item.itemListElement, results);
-  collectJsonLdEntityItems(item.item, results);
-  return results;
-}
-function getResultCandidates(page) {
-  const entityItems = collectJsonLdEntityItems(page.jsonLd ?? []);
-  const entityNames = new Set(
-    entityItems.map((item) => typeof item.name === "string" ? normalizeComparable(item.name) : "").filter(Boolean)
-  );
-  const entityUrls = new Set(
-    entityItems.map((item) => typeof item.url === "string" ? normalizeUrlForMatch(item.url) : null).filter((value) => Boolean(value))
-  );
-  const pageHost = normalizeUrlForMatch(page.url);
-  const searchOrListingPage = isSearchOrListingPage(page);
-  const scored = page.interactiveElements.filter(
-    (element) => element.type === "link" && element.text?.trim() && element.href && !isSiteUtilityLink(element)
-  ).map((element) => {
-    const text = element.text?.trim() || "";
-    const comparableText = normalizeComparable(text);
-    const href = normalizeUrlForMatch(element.href);
-    const haystack = normalizeComparable(
-      [element.text, element.description, element.selector, element.href].filter(Boolean).join(" ")
-    );
-    let score = 0;
-    if (entityNames.has(comparableText)) score += 6;
-    if (href && entityUrls.has(href)) score += 6;
-    if (entityItems.some((item) => {
-      const name = typeof item.name === "string" ? normalizeComparable(item.name) : "";
-      return Boolean(name) && (name.includes(comparableText) || comparableText.includes(name));
-    })) {
-      score += 4;
-    }
-    if (element.context === "article") score += 3;
-    else if (element.context === "main" || element.context === "content") score += 1;
-    if (href && pageHost) {
-      try {
-        if (new URL(href).origin === new URL(pageHost).origin) score += 1;
-      } catch {
-      }
-    }
-    const hrefSegments = getUrlPathSegments(element.href);
-    if (hrefSegments.length >= 2) score += 1;
-    if (text.includes("/")) score += 1;
-    if (searchOrListingPage && (element.context === "article" || element.context === "main" || element.context === "content")) {
-      score += 2;
-    }
-    if (/\b(card|tile|result|rating|review)\b/.test(haystack)) score += 1;
-    if (/\b(item|list|row|repo|repository|issue|pull request|event)\b/.test(haystack)) {
-      score += 1;
-    }
-    if (text.length >= 12 && text.split(/\s+/).length >= 2) score += 1;
-    if (element.context === "nav" || element.context === "header" || element.context === "footer" || element.context === "sidebar" || element.context === "dialog") {
-      score -= 5;
-    }
-    if (/\b(home|menu|about|contact|privacy|terms|login|sign in|sign up|subscribe|newsletter|facebook|instagram|pinterest|share|print|next|previous|prev|sort|filter|star|sponsor)\b/.test(
-      comparableText
-    )) {
-      score -= 4;
-    }
-    return { element, score };
-  }).filter(({ score, element }) => {
-    if (entityItems.length > 0) return score >= 4;
-    if (searchOrListingPage) {
-      return score >= 4 || score >= 3 && (element.context === "article" || element.context === "main" || element.context === "content");
-    }
-    return score >= 4 || score >= 3 && element.context === "article";
-  }).sort((a, b) => b.score - a.score || (a.element.index ?? 0) - (b.element.index ?? 0));
-  const seen = /* @__PURE__ */ new Set();
-  return scored.map(({ element }) => element).filter((element) => {
-    const key2 = `${normalizeComparable(element.text || "")}|${normalizeUrlForMatch(element.href) || ""}`;
-    if (seen.has(key2)) return false;
-    seen.add(key2);
-    return true;
-  });
-}
-function buildScopedContext(page, mode) {
-  const render = SCOPED_CONTEXT_RENDERERS.get(mode) ?? buildStructuredContext;
-  return render(page);
-}
-function buildSummaryContext(page) {
-  const sections = [];
-  const cartSnapshot = formatCartSnapshot(page);
-  sections.push(`**URL:** ${page.url}`);
-  sections.push(`**Title:** ${page.title}`);
-  sections.push(`**Viewport:** ${formatViewport(page)}`);
-  if (page.byline) sections.push(`**Author:** ${page.byline}`);
-  if (page.excerpt) sections.push(`**Summary:** ${page.excerpt}`);
-  const largePageHint = formatLargePageHint(page);
-  if (largePageHint) sections.push(`**Reading Hint:** ${largePageHint}`);
-  const scrollHints = getScrollHints(page);
-  if (scrollHints.length > 0) {
-    sections.push(`**Scroll Hint:** ${scrollHints[0]}`);
-  }
-  sections.push("");
-  const summaryIntent = analyzePageIntent(page);
-  if (summaryIntent) {
-    sections.push(summaryIntent);
-    sections.push("");
+  sections.push("");
+  const summaryIntent = analyzePageIntent(page);
+  if (summaryIntent) {
+    sections.push(summaryIntent);
+    sections.push("");
   }
   if (cartSnapshot) {
     sections.push("### Cart Snapshot");
@@ -19074,16 +19085,216 @@ function handleCreateCheckpoint(ctx, args) {
   const checkpoint = ctx.runtime.createCheckpoint(args.name, args.note);
   return `Created checkpoint ${checkpoint.name} (${checkpoint.id})`;
 }
-function handleRestoreCheckpoint(ctx, args) {
-  const checkpoint = findCheckpoint(ctx.runtime.getState().checkpoints, args);
-  if (!checkpoint) {
-    return "Error: No matching checkpoint found";
+function handleRestoreCheckpoint(ctx, args) {
+  const checkpoint = findCheckpoint(ctx.runtime.getState().checkpoints, args);
+  if (!checkpoint) {
+    return "Error: No matching checkpoint found";
+  }
+  ctx.runtime.restoreCheckpoint(checkpoint.id);
+  return `Restored checkpoint ${checkpoint.name}`;
+}
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
+}
+const logger$q = createLogger("VaultShared");
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const KEY_STORAGE_PREFIX = "base64:";
+function encodeEncryptionKeyForStorage(key2) {
+  return `${KEY_STORAGE_PREFIX}${key2.toString("base64")}`;
+}
+function decodeEncryptionKeyFromStorage(value) {
+  if (value.startsWith(KEY_STORAGE_PREFIX)) {
+    return Buffer.from(value.slice(KEY_STORAGE_PREFIX.length), "base64");
+  }
+  return Buffer.from(value, "utf-8");
+}
+function assertSecretStorageAvailable(customMessage) {
+  if (!electron.safeStorage.isEncryptionAvailable()) {
+    throw new Error(
+      "Vault requires OS-backed secret storage (Keychain, DPAPI, or libsecret)."
+    );
+  }
+}
+function getOrCreateEncryptionKey(keyFilename) {
+  assertSecretStorageAvailable();
+  const keyPath = path.join(electron.app.getPath("userData"), keyFilename);
+  if (fs$1.existsSync(keyPath)) {
+    const encryptedKey = fs$1.readFileSync(keyPath);
+    const key22 = decodeEncryptionKeyFromStorage(
+      electron.safeStorage.decryptString(encryptedKey)
+    );
+    if (key22.length !== 32) {
+      throw new Error("Stored vault encryption key has an invalid length.");
+    }
+    return key22;
+  }
+  const key2 = crypto$1.randomBytes(32);
+  fs$1.mkdirSync(path.dirname(keyPath), { recursive: true });
+  const encrypted = electron.safeStorage.encryptString(encodeEncryptionKeyForStorage(key2));
+  fs$1.writeFileSync(keyPath, encrypted, { mode: 384 });
+  fs$1.chmodSync(keyPath, 384);
+  return key2;
+}
+function createEncryptDecrypt(keyFilename) {
+  let cachedKey = null;
+  function getKey() {
+    if (!cachedKey) cachedKey = getOrCreateEncryptionKey(keyFilename);
+    return cachedKey;
+  }
+  function encrypt2(plaintext) {
+    const key2 = getKey();
+    const iv = crypto$1.randomBytes(IV_LENGTH);
+    const cipher = crypto$1.createCipheriv(ALGORITHM, key2, iv, {
+      authTagLength: AUTH_TAG_LENGTH
+    });
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext, "utf-8"),
+      cipher.final()
+    ]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([iv, authTag, encrypted]);
+  }
+  function decrypt2(data) {
+    const key2 = getKey();
+    const iv = data.subarray(0, IV_LENGTH);
+    const authTag = data.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+    const ciphertext = data.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+    const decipher = crypto$1.createDecipheriv(ALGORITHM, key2, iv, {
+      authTagLength: AUTH_TAG_LENGTH
+    });
+    decipher.setAuthTag(authTag);
+    return decipher.update(ciphertext, void 0, "utf-8") + decipher.final("utf-8");
+  }
+  function resetKey() {
+    cachedKey = null;
+  }
+  return { encrypt: encrypt2, decrypt: decrypt2, resetKey };
+}
+function createVaultIO(vaultFilename, encrypt2, decrypt2) {
+  let cachedEntries = null;
+  function getVaultPath() {
+    return path.join(electron.app.getPath("userData"), vaultFilename);
+  }
+  function loadVault2() {
+    if (cachedEntries) return cachedEntries;
+    const vaultPath = getVaultPath();
+    if (!fs$1.existsSync(vaultPath)) {
+      cachedEntries = [];
+      return cachedEntries;
+    }
+    try {
+      const raw = fs$1.readFileSync(vaultPath);
+      const json = decrypt2(raw);
+      cachedEntries = JSON.parse(json);
+      return cachedEntries;
+    } catch (err) {
+      logger$q.error("Failed to load vault:", err);
+      throw new Error("Could not unlock the vault. Check OS secret storage availability.");
+    }
+  }
+  function saveVault2(entries) {
+    const json = JSON.stringify(entries, null, 2);
+    const encrypted = encrypt2(json);
+    const vaultPath = getVaultPath();
+    fs$1.mkdirSync(path.dirname(vaultPath), { recursive: true });
+    fs$1.writeFileSync(vaultPath, encrypted, { mode: 384 });
+    fs$1.chmodSync(vaultPath, 384);
+    cachedEntries = entries;
+  }
+  function resetCache() {
+    cachedEntries = null;
+  }
+  return { loadVault: loadVault2, saveVault: saveVault2, resetCache };
+}
+function normalizeCredentialHost(value) {
+  try {
+    const parsed = new URL(value.includes("://") ? value : `https://${value}`);
+    return parsed.hostname.toLowerCase().replace(/^www\./, "");
+  } catch {
+    const normalized = value.toLowerCase().trim().replace(/^(https?:\/\/)?(www\.)?/, "").replace(/\/.*$/, "");
+    return normalized && !normalized.includes(" ") ? normalized : null;
+  }
+}
+function domainMatches(pattern, hostname) {
+  const isWildcard = pattern.trim().startsWith("*.");
+  const p = normalizeCredentialHost(isWildcard ? pattern.slice(2) : pattern);
+  const h = normalizeCredentialHost(hostname);
+  if (!p || !h) return false;
+  return isWildcard ? h.endsWith("." + p) : p === h;
+}
+function generateTotpCode(secret) {
+  const epoch = unixNow();
+  const counter = Math.floor(epoch / 30);
+  const base32Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const cleanSecret = secret.replace(/[\s=-]/g, "").toUpperCase();
+  let bits = "";
+  for (const ch of cleanSecret) {
+    const val = base32Chars.indexOf(ch);
+    if (val === -1) continue;
+    bits += val.toString(2).padStart(5, "0");
+  }
+  const keyBytes = Buffer.alloc(Math.floor(bits.length / 8));
+  for (let i = 0; i < keyBytes.length; i++) {
+    keyBytes[i] = parseInt(bits.slice(i * 8, i * 8 + 8), 2);
+  }
+  const counterBuf = Buffer.alloc(8);
+  counterBuf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
+  counterBuf.writeUInt32BE(counter & 4294967295, 4);
+  const hmac = crypto$1.createHmac("sha1", keyBytes).update(counterBuf).digest();
+  const offset = hmac[hmac.length - 1] & 15;
+  const code = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
+  return (code % 1e6).toString().padStart(6, "0");
+}
+function createAuditLog(filename, maxEntries) {
+  function getAuditPath2() {
+    return path.join(electron.app.getPath("userData"), filename);
   }
-  ctx.runtime.restoreCheckpoint(checkpoint.id);
-  return `Restored checkpoint ${checkpoint.name}`;
+  function appendAudit(entry) {
+    try {
+      const auditPath = getAuditPath2();
+      fs$1.mkdirSync(path.dirname(auditPath), { recursive: true });
+      fs$1.appendFileSync(auditPath, JSON.stringify(entry) + "\n", {
+        encoding: "utf-8",
+        mode: 384
+      });
+      fs$1.chmodSync(auditPath, 384);
+      try {
+        const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
+        if (lines.length > maxEntries) {
+          const trimmed = lines.slice(-maxEntries);
+          fs$1.writeFileSync(auditPath, trimmed.join("\n") + "\n", {
+            encoding: "utf-8",
+            mode: 384
+          });
+          fs$1.chmodSync(auditPath, 384);
+        }
+      } catch (err) {
+        logger$q.warn("Failed to trim audit log:", err);
+      }
+    } catch (err) {
+      logger$q.error("Failed to write audit log:", err);
+    }
+  }
+  function readAuditLog2(limit = 100) {
+    try {
+      const auditPath = getAuditPath2();
+      if (!fs$1.existsSync(auditPath)) return [];
+      const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
+      return lines.slice(-Math.min(limit, maxEntries)).map((line) => JSON.parse(line)).reverse();
+    } catch (err) {
+      logger$q.error("Failed to read audit log:", err);
+      return [];
+    }
+  }
+  return { appendAudit, readAuditLog: readAuditLog2 };
 }
-const logger$q = createLogger("Sessions");
+const logger$p = createLogger("Sessions");
 const SESSION_VERSION = 1;
+const ENCRYPTED_SESSION_FORMAT = "vessel:named-session:v2";
+const SESSION_KEY_FILENAME = "vessel-named-sessions.key";
+const sessionCrypto = createEncryptDecrypt(SESSION_KEY_FILENAME);
 function getSessionsDir() {
   return path.join(electron.app.getPath("userData"), "named-sessions");
 }
@@ -19109,17 +19320,40 @@ async function getSessionPath(name) {
   const dir = await ensureSessionsDir();
   return path.join(dir, sessionFileName(name));
 }
+function isEncryptedSessionFile(value) {
+  return !!value && typeof value === "object" && value.format === ENCRYPTED_SESSION_FORMAT && typeof value.payload === "string";
+}
+function encodeSessionFile(data) {
+  const plaintext = JSON.stringify({ version: SESSION_VERSION, ...data });
+  const encrypted = sessionCrypto.encrypt(plaintext);
+  return JSON.stringify(
+    {
+      format: ENCRYPTED_SESSION_FORMAT,
+      payload: encrypted.toString("base64")
+    },
+    null,
+    2
+  );
+}
+function decodeSessionFile(raw) {
+  const parsed = JSON.parse(raw);
+  if (isEncryptedSessionFile(parsed)) {
+    const decrypted = sessionCrypto.decrypt(Buffer.from(parsed.payload, "base64"));
+    return parseSessionData(JSON.parse(decrypted));
+  }
+  return parseSessionData(parsed);
+}
 async function writeSessionFile(filePath2, data) {
-  const payload = JSON.stringify({ version: SESSION_VERSION, ...data }, null, 2);
+  const payload = encodeSessionFile(data);
   await writeFileAtomic(filePath2, payload, { mode: 384 });
 }
 async function readSessionFile(filePath2) {
   const raw = await readIfExists(filePath2, "utf-8");
   if (raw == null) return null;
   try {
-    return parseSessionData(JSON.parse(raw));
+    return decodeSessionFile(raw);
   } catch (err) {
-    logger$q.warn(`Failed to read session file ${filePath2}:`, err);
+    logger$p.warn(`Failed to read session file ${filePath2}:`, err);
     return null;
   }
 }
@@ -19231,7 +19465,7 @@ async function captureLocalStorageForOrigin(tabManager, origin) {
       );
     }
   } catch (err) {
-    logger$q.debug(`Failed to capture localStorage for origin ${origin}:`, err);
+    logger$p.debug(`Failed to capture localStorage for origin ${origin}:`, err);
     return {};
   }
   return {};
@@ -19325,7 +19559,7 @@ async function loadNamedSession(tabManager, name) {
     try {
       await electron.session.defaultSession.cookies.set(cookieSetDetails(cookie));
     } catch (err) {
-      logger$q.debug(`Skipping cookie ${cookie.name} for ${cookie.domain}:`, err);
+      logger$p.debug(`Skipping cookie ${cookie.name} for ${cookie.domain}:`, err);
       continue;
     }
   }
@@ -19394,7 +19628,7 @@ function handleFlowEnd(ctx) {
   ctx.runtime.clearFlow();
   return "Workflow ended.";
 }
-const logger$p = createLogger("Screenshot");
+const logger$o = createLogger("Screenshot");
 const SCREENSHOT_RETRY_COUNT = 3;
 const SCREENSHOT_RETRY_BASE_DELAY_MS = 120;
 async function captureScreenshot(wc) {
@@ -19416,7 +19650,7 @@ async function captureScreenshot(wc) {
         }
       }
     } catch (err) {
-      logger$p.debug(
+      logger$o.debug(
         `capturePage attempt ${attempt + 1} failed; retrying if attempts remain.`,
         getErrorMessage(err)
       );
@@ -20584,10 +20818,7 @@ function normalizeBookmarkMetadataUpdate(input) {
   }
   return normalized;
 }
-function unixNow() {
-  return Math.floor(Date.now() / 1e3);
-}
-const logger$o = createLogger("BookmarkManager");
+const logger$n = createLogger("BookmarkManager");
 const UNSORTED_ID = "unsorted";
 const ARCHIVE_FOLDER_NAME = "Archive";
 const NETSCAPE_BOOKMARKS_DOCTYPE = "<!DOCTYPE NETSCAPE-Bookmark-file-1>";
@@ -21160,7 +21391,7 @@ function importBookmarksFromJson(content) {
       emit$2();
     }
   } catch (err) {
-    logger$o.warn("Failed to import bookmarks from JSON:", err);
+    logger$n.warn("Failed to import bookmarks from JSON:", err);
     errors++;
   }
   return { imported, skipped, errors };
@@ -21819,7 +22050,7 @@ const DANGEROUS_ACTIONS = /* @__PURE__ */ new Set([
 function isDangerousAction(name) {
   return DANGEROUS_ACTIONS.has(name);
 }
-const logger$n = createLogger("ResearchOrchestrator");
+const logger$m = createLogger("ResearchOrchestrator");
 const MAX_THREADS = 5;
 const MAX_TRACE_ARGS_CHARS = 1200;
 const MAX_TRACE_RESULT_CHARS = 2e3;
@@ -22008,7 +22239,7 @@ class ResearchOrchestrator {
   }
   stopAndSynthesizeCurrentFindings() {
     if (this.state.phase !== "executing") {
-      logger$n.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
+      logger$m.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
       return;
     }
     this.stopRequested = true;
@@ -22042,23 +22273,23 @@ class ResearchOrchestrator {
   async startBrief(userQuery) {
     const query = userQuery.trim();
     if (!query) {
-      logger$n.warn("Ignoring empty Research Desk query");
+      logger$m.warn("Ignoring empty Research Desk query");
       return;
     }
     if (this.state.phase !== "idle") {
-      logger$n.warn("Research already in progress, ignoring startBrief");
+      logger$m.warn("Research already in progress, ignoring startBrief");
       return;
     }
     this.state = this.initialState();
     this.state.originalQuery = query;
     this.state.startedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.setPhase("briefing");
-    logger$n.info(`Brief started for query: ${query.slice(0, 120)}`);
+    logger$m.info(`Brief started for query: ${query.slice(0, 120)}`);
   }
   // ── phase: briefing → planning ─────────────────────────────────
   confirmBrief() {
     if (this.state.phase !== "briefing") {
-      logger$n.warn("Not in briefing phase, ignoring confirmBrief");
+      logger$m.warn("Not in briefing phase, ignoring confirmBrief");
       return;
     }
     this.setPhase("planning");
@@ -22066,7 +22297,7 @@ class ResearchOrchestrator {
   // ── phase: planning → awaiting_approval ────────────────────────
   setObjectives(objectives) {
     if (this.state.phase !== "planning") {
-      logger$n.warn("Not in planning phase, ignoring setObjectives");
+      logger$m.warn("Not in planning phase, ignoring setObjectives");
       return;
     }
     const threads = objectives.threads.slice(0, MAX_THREADS).map(mergeBlockedSourceDomains);
@@ -22095,11 +22326,11 @@ class ResearchOrchestrator {
     try {
       const parsed = JSON.parse(json);
       if (typeof parsed.researchQuestion !== "string" || !parsed.researchQuestion.trim()) {
-        logger$n.warn("Missing researchQuestion in objectives JSON");
+        logger$m.warn("Missing researchQuestion in objectives JSON");
         return false;
       }
       if (!Array.isArray(parsed.threads) || parsed.threads.length === 0) {
-        logger$n.warn("Missing or empty threads array in objectives JSON");
+        logger$m.warn("Missing or empty threads array in objectives JSON");
         return false;
       }
       const threads = parsed.threads.map((t, i) => {
@@ -22117,7 +22348,7 @@ class ResearchOrchestrator {
         };
       }).filter((thread) => thread.question && thread.searchQueries.length > 0).slice(0, MAX_THREADS);
       if (threads.length === 0) {
-        logger$n.warn("Objectives JSON did not contain any valid research threads");
+        logger$m.warn("Objectives JSON did not contain any valid research threads");
         return false;
       }
       const objectives = {
@@ -22128,17 +22359,17 @@ class ResearchOrchestrator {
         totalSourceBudget: threads.reduce((sum, t) => sum + t.sourceBudget, 0)
       };
       this.setObjectives(objectives);
-      logger$n.info(`Parsed ${objectives.threads.length} threads from objectives`);
+      logger$m.info(`Parsed ${objectives.threads.length} threads from objectives`);
       return true;
     } catch (err) {
-      logger$n.warn("Failed to parse objectives JSON", err);
+      logger$m.warn("Failed to parse objectives JSON", err);
       return false;
     }
   }
   // ── phase: awaiting_approval → executing ───────────────────────
   approveObjectives(mode, includeTraces) {
     if (this.state.phase !== "awaiting_approval") {
-      logger$n.warn("Not awaiting approval, ignoring approveObjectives");
+      logger$m.warn("Not awaiting approval, ignoring approveObjectives");
       return;
     }
     if (mode) this.state.supervisionMode = mode;
@@ -22173,7 +22404,7 @@ class ResearchOrchestrator {
       this.state.threads.map((thread) => {
         if (this.state.phase !== "executing") return null;
         return this.runSubAgent(thread, tabMutex).catch((err) => {
-          logger$n.error(`Sub-agent "${thread.label}" failed`, err);
+          logger$m.error(`Sub-agent "${thread.label}" failed`, err);
           return {
             threadLabel: thread.label,
             threadQuestion: thread.question,
@@ -22202,7 +22433,7 @@ class ResearchOrchestrator {
     try {
       await this.synthesizeReport();
     } catch (err) {
-      logger$n.error("Auto-synthesis failed", err);
+      logger$m.error("Auto-synthesis failed", err);
       this.state.error = `Synthesis failed: ${String(err)}`;
       this.setPhase("delivered");
     }
@@ -22313,7 +22544,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
         try {
           this.tabManager.closeTab(tabId);
         } catch (err) {
-          logger$n.warn(`Failed to close sub-agent tab ${tabId}`, err);
+          logger$m.warn(`Failed to close sub-agent tab ${tabId}`, err);
         }
       }
     }
@@ -22322,7 +22553,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
       try {
         claims = await this.extractClaimsFromTranscript(thread, transcript);
       } catch (err) {
-        logger$n.warn(`Claim extraction failed for "${thread.label}"`, err);
+        logger$m.warn(`Claim extraction failed for "${thread.label}"`, err);
       }
     }
     if (this.state.phase === "executing" && this.state.includeTraces) {
@@ -22412,7 +22643,7 @@ ${transcript.slice(0, 32e3)}`;
         (claim) => claim.claim && claim.sourceUrl && claim.extractedQuote
       );
     } catch {
-      logger$n.warn(`Failed to parse claims JSON for "${thread.label}"`);
+      logger$m.warn(`Failed to parse claims JSON for "${thread.label}"`);
       return [];
     }
   }
@@ -22497,7 +22728,7 @@ ${transcript.slice(0, 32e3)}`;
         objectives
       };
     } catch (err) {
-      logger$n.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
+      logger$m.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
       return buildFallbackReport(objectives, findings, String(err));
     }
   }
@@ -23072,7 +23303,7 @@ function loadRenderers(chromeView, sidebarView, devtoolsPanelView) {
     });
   }
 }
-const logger$m = createLogger("PrivateWindow");
+const logger$l = createLogger("PrivateWindow");
 const privateWindows = /* @__PURE__ */ new Set();
 function layoutPrivateViews(state2) {
   const { window: win, chromeView, tabManager } = state2;
@@ -23302,7 +23533,7 @@ function createPrivateWindow() {
         privateSession.clearStorageData(),
         privateSession.clearCache()
       ]).catch((error) => {
-        logger$m.warn("Failed to clear private browsing session:", error);
+        logger$l.warn("Failed to clear private browsing session:", error);
       });
     });
     privateWindows.add(state2);
@@ -23311,38 +23542,38 @@ function createPrivateWindow() {
         tabManager?.createTab("about:blank");
         if (state2) layoutPrivateViews(state2);
       } catch (error) {
-        logger$m.error("Failed to initialize private browsing tab:", error);
+        logger$l.error("Failed to initialize private browsing tab:", error);
         try {
           win?.close();
         } catch (cleanupError) {
-          logger$m.warn("Failed to close private window after tab init failure:", cleanupError);
+          logger$l.warn("Failed to close private window after tab init failure:", cleanupError);
         }
       }
     });
     loadPrivateRenderer(chromeView);
     win.show();
-    logger$m.info("Private browsing window opened");
+    logger$l.info("Private browsing window opened");
     return state2;
   } catch (error) {
-    logger$m.error("Failed to create private browsing window:", error);
+    logger$l.error("Failed to create private browsing window:", error);
     if (state2) {
       privateWindows.delete(state2);
     }
     try {
       tabManager?.destroyAllTabs();
     } catch (cleanupError) {
-      logger$m.warn("Failed to clean up private tabs after launch failure:", cleanupError);
+      logger$l.warn("Failed to clean up private tabs after launch failure:", cleanupError);
     }
     try {
       win?.close();
     } catch (cleanupError) {
-      logger$m.warn("Failed to close private window after launch failure:", cleanupError);
+      logger$l.warn("Failed to close private window after launch failure:", cleanupError);
     }
     void Promise.all([
       privateSession.clearStorageData(),
       privateSession.clearCache()
     ]).catch((cleanupError) => {
-      logger$m.warn("Failed to clear failed private browsing session:", cleanupError);
+      logger$l.warn("Failed to clear failed private browsing session:", cleanupError);
     });
     throw error;
   }
@@ -23559,7 +23790,11 @@ const window$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProp
 const TabIdSchema$1 = zod.z.string().min(1);
 const GroupIdSchema = zod.z.string().min(1);
 const UrlSchema = zod.z.string().min(1);
-const ColorSchema = zod.z.string().min(1);
+const NavigationPostBodySchema = zod.z.record(zod.z.string(), zod.z.string()).optional();
+const ColorSchema = zod.z.custom(
+  (color) => typeof color === "string" && TAB_GROUP_COLORS.includes(color),
+  { message: "Invalid tab group color" }
+);
 const FindActionSchema = zod.z.enum(["clearSelection", "keepSelection", "activateSelection"]);
 const FindTextSchema = zod.z.string().min(1).max(1e4);
 const FindOptionsSchema = zod.z.object({
@@ -23605,7 +23840,12 @@ function registerTabHandlers(windowState, _sendToRendererViews) {
       assertTrustedIpcSender(event);
       const validatedId = parseIpc(TabIdSchema$1, id, "tabId");
       const validatedUrl = parseIpc(UrlSchema, url, "url");
-      return tabManager.navigateTab(validatedId, validatedUrl, postBody);
+      const validatedPostBody = parseIpc(
+        NavigationPostBodySchema,
+        postBody,
+        "postBody"
+      );
+      return tabManager.navigateTab(validatedId, validatedUrl, validatedPostBody);
     }
   );
   electron.ipcMain.handle(Channels.TAB_BACK, (event, id) => {
@@ -23741,7 +23981,7 @@ function registerTabHandlers(windowState, _sendToRendererViews) {
   );
 }
 const require$1 = node_module.createRequire(require("url").pathToFileURL(__filename).href);
-const logger$l = createLogger("DevTrace");
+const logger$k = createLogger("DevTrace");
 let cachedFactory;
 function createNoopTraceSession() {
   return {
@@ -23774,7 +24014,7 @@ function loadLocalFactory() {
         return cachedFactory;
       }
     } catch (err) {
-      logger$l.warn("Failed to load local trace logger:", err);
+      logger$k.warn("Failed to load local trace logger:", err);
     }
   }
   return cachedFactory;
@@ -24682,7 +24922,7 @@ function registerContentHandlers(windowState) {
     return windowState.uiState.focusMode;
   });
 }
-const logger$k = createLogger("HighlightIPC");
+const logger$j = createLogger("HighlightIPC");
 const HighlightIndexSchema = zod.z.number().int().min(0);
 function registerHighlightHandlers(windowState, sendToRendererViews) {
   const { tabManager, chromeView } = windowState;
@@ -24692,7 +24932,7 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
     try {
       return await getHighlightCount(info.wc) ?? 0;
     } catch (err) {
-      logger$k.warn("Failed to get active highlight count:", err);
+      logger$j.warn("Failed to get active highlight count:", err);
       return 0;
     }
   };
@@ -24717,13 +24957,13 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
       const result = await captureSelectionHighlight(wc);
       if (result.success && result.text) {
         await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(
-          (err) => logger$k.warn("Failed to highlight captured selection:", err)
+          (err) => logger$j.warn("Failed to highlight captured selection:", err)
         );
         await emitHighlightCount();
       }
       return result;
     } catch (err) {
-      logger$k.warn("Failed to capture highlight from active tab:", err);
+      logger$j.warn("Failed to capture highlight from active tab:", err);
       return { success: false, message: "Could not capture selection" };
     }
   });
@@ -24741,7 +24981,7 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
         }
       });
     } catch (err) {
-      logger$k.warn("Failed to persist auto-highlight selection:", err);
+      logger$j.warn("Failed to persist auto-highlight selection:", err);
     }
   });
   electron.ipcMain.handle(Channels.HIGHLIGHT_NAV_COUNT, (event) => {
@@ -24756,7 +24996,7 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
     try {
       return scrollToHighlight(info.wc, validatedIndex);
     } catch (err) {
-      logger$k.warn("Failed to scroll to highlight:", err);
+      logger$j.warn("Failed to scroll to highlight:", err);
       return false;
     }
   });
@@ -24780,7 +25020,7 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
       }
       return removed;
     } catch (err) {
-      logger$k.warn("Failed to remove highlight at index:", err);
+      logger$j.warn("Failed to remove highlight at index:", err);
       return false;
     }
   });
@@ -24797,7 +25037,7 @@ function registerHighlightHandlers(windowState, sendToRendererViews) {
       }
       return cleared;
     } catch (err) {
-      logger$k.warn("Failed to clear highlight elements:", err);
+      logger$j.warn("Failed to clear highlight elements:", err);
       return false;
     }
   });
@@ -26160,7 +26400,7 @@ async function linkBookmarkToMemory({
     }
   });
 }
-const logger$j = createLogger("MCP");
+const logger$i = createLogger("MCP");
 function asTextResponse(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -26261,7 +26501,7 @@ async function getPostActionState(tabManager, name) {
         }
       }
     } catch (err) {
-      logger$j.warn("Failed to compute post-action state warning:", err);
+      logger$i.warn("Failed to compute post-action state warning:", err);
     }
     return `${warning}
 [state: url=${wc.getURL()}, canGoBack=${tab.canGoBack()}, canGoForward=${tab.canGoForward()}, loading=${wc.isLoading()}]`;
@@ -26366,7 +26606,7 @@ async function waitForConditionMcp(wc, text, selector, timeoutMs) {
         }
       })()
     `).catch((err) => {
-      logger$j.warn("Failed to gather wait_for timeout diagnostic:", err);
+      logger$i.warn("Failed to gather wait_for timeout diagnostic:", err);
       return null;
     });
     if (typeof diagnostic === "string" && diagnostic.trim()) {
@@ -27234,7 +27474,7 @@ function registerSessionTools(server, tabManager, runtime2) {
     )
   );
 }
-const logger$i = createLogger("MCPContentTools");
+const logger$h = createLogger("MCPContentTools");
 const EXTRACT_MODES = [
   "full",
   "summary",
@@ -27659,7 +27899,7 @@ To analyze visually, call vision_analyze with image_url="${screenshotPath}"`
       try {
         page = await extractContent(wc);
       } catch (err) {
-        logger$i.warn("Failed to extract page while generating suggestions:", err);
+        logger$h.warn("Failed to extract page while generating suggestions:", err);
         return asTextResponse(
           "Could not read page. Try navigate to a working URL."
         );
@@ -28511,7 +28751,7 @@ function registerNavigationTools(server, tabManager, runtime2) {
     }
   );
 }
-const logger$h = createLogger("MCPPrompts");
+const logger$g = createLogger("MCPPrompts");
 function registerPromptTools(server, tabManager, runtime2) {
   server.registerPrompt(
     "vessel-supervisor-brief",
@@ -28590,7 +28830,7 @@ function registerPromptTools(server, tabManager, runtime2) {
           const page = await extractContent(wc);
           pageType = detectPageType(page);
         } catch (err) {
-          logger$h.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
+          logger$g.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
         }
       }
       const scored = TOOL_DEFINITIONS.map((def) => {
@@ -28635,6 +28875,11 @@ function registerPromptTools(server, tabManager, runtime2) {
     }
   );
 }
+const TAB_GROUP_COLOR_SET = new Set(TAB_GROUP_COLORS);
+const TabGroupColorSchema = zod.z.custom(
+  (color) => typeof color === "string" && TAB_GROUP_COLOR_SET.has(color),
+  { message: "Invalid tab group color" }
+);
 function registerGroupTools(server, tabManager, runtime2) {
   server.registerTool(
     "list_groups",
@@ -28663,7 +28908,7 @@ function registerGroupTools(server, tabManager, runtime2) {
       inputSchema: {
         tabId: zod.z.string().optional().describe("Tab ID to group (defaults to active tab)"),
         name: zod.z.string().optional().describe("Optional group name"),
-        color: zod.z.enum(["blue", "green", "yellow", "orange", "red", "purple", "gray"]).optional().describe("Optional group color")
+        color: TabGroupColorSchema.optional().describe("Optional group color")
       }
     },
     async ({ tabId, name, color }) => withAction(runtime2, tabManager, "create_group", { tabId, name, color }, async () => {
@@ -28742,16 +28987,20 @@ function registerGroupTools(server, tabManager, runtime2) {
       description: "Change the color of a tab group.",
       inputSchema: {
         groupId: zod.z.string().describe("Group ID"),
-        color: zod.z.enum(["blue", "green", "yellow", "orange", "red", "purple", "gray"]).describe("New color")
+        color: TabGroupColorSchema.describe("New color")
       }
     },
     async ({ groupId, color }) => withAction(runtime2, tabManager, "set_group_color", { groupId, color }, async () => {
+      const groupExists = tabManager.getGroups().some((group) => group.id === groupId);
+      if (!groupExists) {
+        return "Error: Group not found";
+      }
       tabManager.setGroupColor(groupId, color);
       return `Set group ${groupId} color to ${color}`;
     })
   );
 }
-const logger$g = createLogger("MCPHighlightTools");
+const logger$f = createLogger("MCPHighlightTools");
 function registerHighlightTools(server, tabManager, runtime2) {
   server.registerTool(
     "highlight",
@@ -28968,7 +29217,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
             void 0,
             h.color
           ).catch(
-            (err) => logger$g.warn("Failed to restore highlight after removal:", err)
+            (err) => logger$f.warn("Failed to restore highlight after removal:", err)
           );
         }
       }
@@ -29487,7 +29736,7 @@ ${steps.join("\n")}`;
 }
 const AUDIT_FILENAME = "vessel-vault-audit.jsonl";
 const MAX_ENTRIES = 1e3;
-const logger$f = createLogger("VaultAudit");
+const logger$e = createLogger("VaultAudit");
 function getAuditPath() {
   return path.join(electron.app.getPath("userData"), AUDIT_FILENAME);
 }
@@ -29501,7 +29750,7 @@ function appendAuditEntry(entry) {
     });
     fs$1.chmodSync(auditPath, 384);
   } catch (err) {
-    logger$f.error("Failed to write audit log:", err);
+    logger$e.error("Failed to write audit log:", err);
   }
 }
 function readAuditLog$1(limit = 100) {
@@ -29511,7 +29760,7 @@ function readAuditLog$1(limit = 100) {
     const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
     return lines.slice(-Math.min(limit, MAX_ENTRIES)).map((line) => JSON.parse(line)).reverse();
   } catch (err) {
-    logger$f.error("Failed to read audit log:", err);
+    logger$e.error("Failed to read audit log:", err);
     return [];
   }
 }
@@ -29580,200 +29829,6 @@ async function requestHumanVaultConsent(request) {
   });
   return { approved: response === 1 };
 }
-const logger$e = createLogger("VaultShared");
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
-const KEY_STORAGE_PREFIX = "base64:";
-function encodeEncryptionKeyForStorage(key2) {
-  return `${KEY_STORAGE_PREFIX}${key2.toString("base64")}`;
-}
-function decodeEncryptionKeyFromStorage(value) {
-  if (value.startsWith(KEY_STORAGE_PREFIX)) {
-    return Buffer.from(value.slice(KEY_STORAGE_PREFIX.length), "base64");
-  }
-  return Buffer.from(value, "utf-8");
-}
-function assertSecretStorageAvailable(customMessage) {
-  if (!electron.safeStorage.isEncryptionAvailable()) {
-    throw new Error(
-      "Vault requires OS-backed secret storage (Keychain, DPAPI, or libsecret)."
-    );
-  }
-}
-function getOrCreateEncryptionKey(keyFilename) {
-  assertSecretStorageAvailable();
-  const keyPath = path.join(electron.app.getPath("userData"), keyFilename);
-  if (fs$1.existsSync(keyPath)) {
-    const encryptedKey = fs$1.readFileSync(keyPath);
-    const key22 = decodeEncryptionKeyFromStorage(
-      electron.safeStorage.decryptString(encryptedKey)
-    );
-    if (key22.length !== 32) {
-      throw new Error("Stored vault encryption key has an invalid length.");
-    }
-    return key22;
-  }
-  const key2 = crypto$1.randomBytes(32);
-  fs$1.mkdirSync(path.dirname(keyPath), { recursive: true });
-  const encrypted = electron.safeStorage.encryptString(encodeEncryptionKeyForStorage(key2));
-  fs$1.writeFileSync(keyPath, encrypted, { mode: 384 });
-  fs$1.chmodSync(keyPath, 384);
-  return key2;
-}
-function createEncryptDecrypt(keyFilename) {
-  let cachedKey = null;
-  function getKey() {
-    if (!cachedKey) cachedKey = getOrCreateEncryptionKey(keyFilename);
-    return cachedKey;
-  }
-  function encrypt2(plaintext) {
-    const key2 = getKey();
-    const iv = crypto$1.randomBytes(IV_LENGTH);
-    const cipher = crypto$1.createCipheriv(ALGORITHM, key2, iv, {
-      authTagLength: AUTH_TAG_LENGTH
-    });
-    const encrypted = Buffer.concat([
-      cipher.update(plaintext, "utf-8"),
-      cipher.final()
-    ]);
-    const authTag = cipher.getAuthTag();
-    return Buffer.concat([iv, authTag, encrypted]);
-  }
-  function decrypt2(data) {
-    const key2 = getKey();
-    const iv = data.subarray(0, IV_LENGTH);
-    const authTag = data.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-    const ciphertext = data.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-    const decipher = crypto$1.createDecipheriv(ALGORITHM, key2, iv, {
-      authTagLength: AUTH_TAG_LENGTH
-    });
-    decipher.setAuthTag(authTag);
-    return decipher.update(ciphertext, void 0, "utf-8") + decipher.final("utf-8");
-  }
-  function resetKey() {
-    cachedKey = null;
-  }
-  return { encrypt: encrypt2, decrypt: decrypt2, resetKey };
-}
-function createVaultIO(vaultFilename, encrypt2, decrypt2) {
-  let cachedEntries = null;
-  function getVaultPath() {
-    return path.join(electron.app.getPath("userData"), vaultFilename);
-  }
-  function loadVault2() {
-    if (cachedEntries) return cachedEntries;
-    const vaultPath = getVaultPath();
-    if (!fs$1.existsSync(vaultPath)) {
-      cachedEntries = [];
-      return cachedEntries;
-    }
-    try {
-      const raw = fs$1.readFileSync(vaultPath);
-      const json = decrypt2(raw);
-      cachedEntries = JSON.parse(json);
-      return cachedEntries;
-    } catch (err) {
-      logger$e.error("Failed to load vault:", err);
-      throw new Error("Could not unlock the vault. Check OS secret storage availability.");
-    }
-  }
-  function saveVault2(entries) {
-    const json = JSON.stringify(entries, null, 2);
-    const encrypted = encrypt2(json);
-    const vaultPath = getVaultPath();
-    fs$1.mkdirSync(path.dirname(vaultPath), { recursive: true });
-    fs$1.writeFileSync(vaultPath, encrypted, { mode: 384 });
-    fs$1.chmodSync(vaultPath, 384);
-    cachedEntries = entries;
-  }
-  function resetCache() {
-    cachedEntries = null;
-  }
-  return { loadVault: loadVault2, saveVault: saveVault2, resetCache };
-}
-function normalizeCredentialHost(value) {
-  try {
-    const parsed = new URL(value.includes("://") ? value : `https://${value}`);
-    return parsed.hostname.toLowerCase().replace(/^www\./, "");
-  } catch {
-    const normalized = value.toLowerCase().trim().replace(/^(https?:\/\/)?(www\.)?/, "").replace(/\/.*$/, "");
-    return normalized && !normalized.includes(" ") ? normalized : null;
-  }
-}
-function domainMatches(pattern, hostname) {
-  const isWildcard = pattern.trim().startsWith("*.");
-  const p = normalizeCredentialHost(isWildcard ? pattern.slice(2) : pattern);
-  const h = normalizeCredentialHost(hostname);
-  if (!p || !h) return false;
-  return isWildcard ? h.endsWith("." + p) : p === h;
-}
-function generateTotpCode(secret) {
-  const epoch = unixNow();
-  const counter = Math.floor(epoch / 30);
-  const base32Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const cleanSecret = secret.replace(/[\s=-]/g, "").toUpperCase();
-  let bits = "";
-  for (const ch of cleanSecret) {
-    const val = base32Chars.indexOf(ch);
-    if (val === -1) continue;
-    bits += val.toString(2).padStart(5, "0");
-  }
-  const keyBytes = Buffer.alloc(Math.floor(bits.length / 8));
-  for (let i = 0; i < keyBytes.length; i++) {
-    keyBytes[i] = parseInt(bits.slice(i * 8, i * 8 + 8), 2);
-  }
-  const counterBuf = Buffer.alloc(8);
-  counterBuf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
-  counterBuf.writeUInt32BE(counter & 4294967295, 4);
-  const hmac = crypto$1.createHmac("sha1", keyBytes).update(counterBuf).digest();
-  const offset = hmac[hmac.length - 1] & 15;
-  const code = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
-  return (code % 1e6).toString().padStart(6, "0");
-}
-function createAuditLog(filename, maxEntries) {
-  function getAuditPath2() {
-    return path.join(electron.app.getPath("userData"), filename);
-  }
-  function appendAudit(entry) {
-    try {
-      const auditPath = getAuditPath2();
-      fs$1.mkdirSync(path.dirname(auditPath), { recursive: true });
-      fs$1.appendFileSync(auditPath, JSON.stringify(entry) + "\n", {
-        encoding: "utf-8",
-        mode: 384
-      });
-      fs$1.chmodSync(auditPath, 384);
-      try {
-        const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
-        if (lines.length > maxEntries) {
-          const trimmed = lines.slice(-maxEntries);
-          fs$1.writeFileSync(auditPath, trimmed.join("\n") + "\n", {
-            encoding: "utf-8",
-            mode: 384
-          });
-          fs$1.chmodSync(auditPath, 384);
-        }
-      } catch (err) {
-        logger$e.warn("Failed to trim audit log:", err);
-      }
-    } catch (err) {
-      logger$e.error("Failed to write audit log:", err);
-    }
-  }
-  function readAuditLog2(limit = 100) {
-    try {
-      const auditPath = getAuditPath2();
-      if (!fs$1.existsSync(auditPath)) return [];
-      const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
-      return lines.slice(-Math.min(limit, maxEntries)).map((line) => JSON.parse(line)).reverse();
-    } catch (err) {
-      logger$e.error("Failed to read audit log:", err);
-      return [];
-    }
-  }
-  return { appendAudit, readAuditLog: readAuditLog2 };
-}
 const VAULT_FILENAME$1 = "vessel-human-vault.enc";
 const KEY_FILENAME$1 = "vessel-human-vault.key";
 const AUDIT_MAX_ENTRIES = 2e3;
@@ -30710,9 +30765,10 @@ async function submitFeedback(payload) {
     return errorResult(getErrorMessage(error, "Failed to send feedback."));
   }
 }
-const SettingsKeySchema = zod.z.string().refine((k) => SETTABLE_KEYS.has(k), {
-  message: "Unknown setting key"
-});
+const SettingsKeySchema = zod.z.custom(
+  (key2) => typeof key2 === "string" && RENDERER_SETTABLE_KEYS.has(key2),
+  { message: "Unknown setting key" }
+);
 function registerSettingsHandlers(tabManager, runtime2, sendToRendererViews, getResearchOrchestrator) {
   const applySettingChange = async (key2, value) => {
     const updatedSettings = setSetting(key2, value);
@@ -30758,8 +30814,7 @@ function registerSettingsHandlers(tabManager, runtime2, sendToRendererViews, get
   });
   electron.ipcMain.handle(Channels.SETTINGS_SET, async (event, key2, value) => {
     assertTrustedIpcSender(event);
-    const validatedKey = parseIpc(SettingsKeySchema, key2, "key");
-    const settingsKey = validatedKey;
+    const settingsKey = parseIpc(SettingsKeySchema, key2, "key");
     const validatedValue = parseSettingValue(settingsKey, value);
     return applySettingChange(settingsKey, validatedValue);
   });