@wenathlan/extension 1.1.30 → 1.1.32

package/extension/dist/background.js

@@ -28,12 +28,43 @@ var sessionmemory = class {
   async setdiagnostic(value) {
     return this.adapter.set("diagnostic", value);
   }
+  async getprogress() {
+    return this.adapter.get("progress");
+  }
+  async setprogress(value) {
+    return this.adapter.set("progress", value);
+  }
+  async getcapabilities() {
+    return this.adapter.get("capabilities");
+  }
+  async setcapabilities(value) {
+    return this.adapter.set("capabilities", value);
+  }
+  async getsettings() {
+    return this.adapter.get("settings");
+  }
+  async setsettings(value) {
+    return this.adapter.set("settings", value);
+  }
   async getaudit() {
     return await this.adapter.get("audit") ?? [];
   }
+  async getoutcomes() {
+    return await this.adapter.get("outcomes") ?? [];
+  }
+  /** Records one audit event; retention is a user setting and an absent setting keeps every event. */
   async addaudi(event) {
     const records = await this.getaudit();
-    await this.adapter.set("audit", [event, ...records].slice(0, 100));
+    const combined = [event, ...records];
+    const retention = (await this.getsettings())?.auditretention;
+    await this.adapter.set("audit", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Records one step outcome; retention is a user setting and an absent setting keeps every outcome. */
+  async addoutcome(outcome) {
+    const records = await this.getoutcomes();
+    const combined = [outcome, ...records];
+    const retention = (await this.getsettings())?.outcomeretention;
+    await this.adapter.set("outcomes", retention === void 0 ? combined : combined.slice(0, retention));
   }
 };
 function randomid() {
@@ -41,8 +72,12 @@ function randomid() {
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate"]);
-var allowedactions = /* @__PURE__ */ new Set(["observe", "inspect", "focus", "click", "type", "navigate"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot"]);
+var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
+var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor"]);
+var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile"]);
 function normalizeendpoint(value) {
   const endpoint = new URL(value.trim());
   if (endpoint.protocol !== "https:") throw new Error("Devthink accepts HTTPS endpoints only.");
@@ -57,44 +92,141 @@ function hostpattern(origin) {
 function actionrisk(kind) {
   if (!allowedactions.has(kind)) throw new Error("Unsupported browser action.");
   if (sensitiveactions.has(kind)) return "sensitive";
-  return kind === "focus" ? "interaction" : "read";
+  return interactionactions.has(kind) ? "interaction" : "read";
+}
+function parseoptions(step) {
+  if (step.options === void 0) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(step.options);
+  } catch {
+    throw new Error("Step options must be a JSON object.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Step options must be a JSON object.");
+  return parsed;
+}
+function requiredcapability(kind) {
+  if (kind === "tablist") return "tabs";
+  if (kind === "downloadfile") return "downloads";
+  return void 0;
+}
+function waitduration(step) {
+  const requested = step.value ? Number.parseInt(step.value, 10) : 250;
+  if (!Number.isFinite(requested) || requested < 0) throw new Error("Wait duration must be zero or a positive number of milliseconds.");
+  return requested;
+}
+function isnumericid(value) {
+  return typeof value === "string" && /^\d+$/.test(value);
+}
+function numericoption(options, key) {
+  return options[key] === void 0 || typeof options[key] === "number" && Number.isFinite(options[key]);
 }
 function validatestep(step, origin) {
   if (!allowedactions.has(step.kind)) return { allowed: false, reason: "Unsupported action kind." };
   if (!step.summary.trim()) return { allowed: false, reason: "A human-readable action summary is required." };
-  if ((step.kind === "click" || step.kind === "focus" || step.kind === "inspect" || step.kind === "type") && !step.target?.trim()) return { allowed: false, reason: "A page target is required." };
+  if (targetactions.has(step.kind) && !step.target?.trim()) return { allowed: false, reason: "A page target is required." };
+  if (valueactions.has(step.kind) && !step.value?.trim()) return { allowed: false, reason: "A reviewed value is required." };
+  if (step.kind === "select" && !step.value?.trim()) return { allowed: false, reason: "A reviewed option value is required." };
+  if (step.kind === "navigate" && !step.value) return { allowed: false, reason: "A navigation URL is required." };
+  let options;
+  try {
+    options = parseoptions(step);
+  } catch {
+    return { allowed: false, reason: "Step options must be a JSON object." };
+  }
+  if (step.kind === "wait") {
+    try {
+      waitduration(step);
+    } catch {
+      return { allowed: false, reason: "Wait duration must be zero or a positive number of milliseconds." };
+    }
+  }
   if (step.kind === "navigate") {
-    if (!step.value) return { allowed: false, reason: "A navigation URL is required." };
     try {
-      if (new URL(step.value).origin !== origin) return { allowed: false, reason: "Navigation must remain within the approved origin." };
+      if (new URL(step.value ?? "").origin !== origin) return { allowed: false, reason: "Navigation must remain within the approved origin." };
     } catch {
       return { allowed: false, reason: "Navigation URL is invalid." };
     }
   }
+  if (step.kind === "tabcreate" || step.kind === "windowcreate" || step.kind === "downloadfile") {
+    try {
+      const url = new URL(step.value ?? "");
+      if (url.protocol !== "https:") return { allowed: false, reason: "The reviewed URL must use HTTPS." };
+    } catch {
+      return { allowed: false, reason: "The reviewed URL is invalid." };
+    }
+  }
+  if (step.kind === "tabactivate" || step.kind === "tabclose" || step.kind === "tabreload" || step.kind === "windowclose" || step.kind === "windowresize") {
+    if (!isnumericid(step.value)) return { allowed: false, reason: "A numeric browser id is required." };
+  }
+  if (step.kind === "zoomset") {
+    const zoom = Number(step.value);
+    if (!Number.isFinite(zoom) || zoom <= 0) return { allowed: false, reason: "The reviewed zoom must be a positive number." };
+  }
+  if (step.kind === "setattribute" || step.kind === "writestorage") {
+    const keyname = step.kind === "setattribute" ? "name" : "key";
+    if (typeof options[keyname] !== "string" || !options[keyname].trim()) return { allowed: false, reason: `A reviewed ${keyname} is required in options.` };
+    if (typeof options.value !== "string") return { allowed: false, reason: "A reviewed value is required in options." };
+  }
+  if (step.kind === "windowresize") {
+    if (typeof options.width !== "number" || typeof options.height !== "number" || !Number.isFinite(options.width) || !Number.isFinite(options.height)) return { allowed: false, reason: "Reviewed width and height numbers are required in options." };
+  }
+  if ((step.kind === "scrollpage" || step.kind === "scrollby") && (!numericoption(options, "x") || !numericoption(options, "y"))) return { allowed: false, reason: "Scroll amounts must be numbers in options." };
+  if (step.kind === "waitfor" && options.timeout !== void 0 && (typeof options.timeout !== "number" || options.timeout < 0)) return { allowed: false, reason: "The waitfor timeout must be zero or a positive number of milliseconds." };
+  return { allowed: true };
+}
+function sessiongate(input) {
+  if (!input.session || input.session.stoppedat) return { allowed: false, reason: "No active browser session exists." };
+  if (input.session.expiresat <= input.now) return { allowed: false, reason: "The browser session has expired." };
+  if (input.session.pausedat) return { allowed: false, reason: `The browser session is paused and cannot ${input.action}.` };
+  if (input.session.tabid !== input.tabid || input.session.origin !== input.origin) return { allowed: false, reason: `The ${input.action} is outside the approved tab or origin.` };
   return { allowed: true };
 }
 function canexecute(input) {
   const now = input.now ?? Date.now();
-  if (!input.session || input.session.stoppedat) return { allowed: false, reason: "No active browser session exists." };
-  if (input.session.expiresat <= now) return { allowed: false, reason: "The browser session has expired." };
-  if (input.session.tabid !== input.tabid || input.session.origin !== input.origin) return { allowed: false, reason: "The action is outside the approved tab or origin." };
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "execute an action" });
+  if (!gate.allowed) return gate;
   if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "The plan has not received explicit approval." };
   if (input.plan.expiresat <= now) return { allowed: false, reason: "The approved plan has expired." };
   return validatestep(input.step, input.origin);
 }
 function canpreview(input) {
   const now = input.now ?? Date.now();
-  if (!input.session || input.session.stoppedat) return { allowed: false, reason: "No active browser session exists." };
-  if (input.session.expiresat <= now) return { allowed: false, reason: "The browser session has expired." };
-  if (input.session.tabid !== input.tabid || input.session.origin !== input.origin) return { allowed: false, reason: "The preview is outside the approved tab or origin." };
+  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "preview a target" });
+  if (!gate.allowed) return gate;
   if (!input.plan || !["pending", "approved"].includes(input.plan.state)) return { allowed: false, reason: "Only a reviewed pending or approved plan can be previewed." };
   if (input.plan.expiresat <= now) return { allowed: false, reason: "The reviewed plan has expired." };
-  if (!["focus", "inspect", "click", "type"].includes(input.step.kind)) return { allowed: false, reason: "Only a target-based action can be previewed." };
+  if (!targetactions.has(input.step.kind)) return { allowed: false, reason: "Only a target-based action can be previewed." };
   return validatestep(input.step, input.origin);
 }
 
+// progress.ts
+function emptyprogress(planid, now) {
+  return { planid, completedsteps: [], updatedat: now };
+}
+function recordstep(progress, planid, stepid, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  if (base.completedsteps.includes(stepid)) return { ...base, updatedat: now };
+  return { planid, completedsteps: [...base.completedsteps, stepid], updatedat: now };
+}
+function recordoutcome(progress, planid, outcome, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  return { ...base, outcomes: [...base.outcomes ?? [], outcome], updatedat: now };
+}
+function iscomplete(progress, plan) {
+  if (!progress || progress.planid !== plan.id) return false;
+  const required = plan.steps.map((step) => step.id);
+  return required.length > 0 && required.every((id) => progress.completedsteps.includes(id));
+}
+function resetforplan(progress, plan, now) {
+  if (progress && progress.planid === plan.id) return progress;
+  if (!progress) return emptyprogress(plan.id, now);
+  const snapshot2 = { planid: progress.planid, completedsteps: progress.completedsteps, ...progress.outcomes ? { outcomes: progress.outcomes } : {}, updatedat: progress.updatedat };
+  return { planid: plan.id, completedsteps: [], outcomes: [], prior: [...progress.prior ?? [], snapshot2], updatedat: now };
+}
+
 // version.ts
-var packageversion = "1.1.30";
+var packageversion = "1.1.32";
 
 // types.ts
 var protocolversion = packageversion;
@@ -113,7 +245,7 @@ function parseproposal(value, origin) {
   if (root.version !== protocolversion) throw new Error("Unsupported protocol version.");
   const planinput = record(root.plan);
   const stepsinput = planinput.steps;
-  if (!Array.isArray(stepsinput) || stepsinput.length === 0 || stepsinput.length > 20) throw new Error("A plan needs between one and twenty steps.");
+  if (!Array.isArray(stepsinput) || stepsinput.length === 0) throw new Error("A plan needs at least one step.");
   const steps = stepsinput.map((input, index) => {
     const candidate = record(input);
     const kind = text(candidate.kind, `step ${index + 1} kind`);
@@ -123,31 +255,117 @@ function parseproposal(value, origin) {
       summary: text(candidate.summary, `step ${index + 1} summary`),
       risk: actionrisk(kind),
       ...typeof candidate.target === "string" ? { target: candidate.target } : {},
-      ...typeof candidate.value === "string" ? { value: candidate.value } : {}
+      ...typeof candidate.value === "string" ? { value: candidate.value } : {},
+      ...typeof candidate.options === "string" ? { options: candidate.options } : {}
     };
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     return step;
   });
   const createdat = Date.now();
+  const expiresat = typeof planinput.expiresat === "number" ? planinput.expiresat : createdat + 10 * 60 * 1e3;
   const plan = {
     id: typeof planinput.id === "string" ? planinput.id : crypto.randomUUID(),
     objective: text(planinput.objective, "objective"),
     origin,
     steps,
     createdat,
-    expiresat: Math.min(typeof planinput.expiresat === "number" ? planinput.expiresat : createdat + 10 * 60 * 1e3, createdat + 30 * 60 * 1e3),
+    expiresat,
     state: "pending"
   };
   if (plan.expiresat <= createdat) throw new Error("Plan expiry must be in the future.");
   return { version: protocolversion, plan };
 }
 function requestbody(input) {
-  return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation });
+  return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
+}
+
+// extension/browsertabs.ts
+var browserkinds = /* @__PURE__ */ new Set(["tablist", "tabcreate", "tabactivate", "tabclose", "tabreload", "tabsnapshot", "windowlist", "windowcreate", "windowclose", "zoomset", "windowresize", "downloadfile"]);
+function isbrowserkind(kind) {
+  return browserkinds.has(kind);
+}
+async function readcapabilities() {
+  const [tabs, downloads, clipboardread, clipboardwrite] = await Promise.all([
+    chrome.permissions.contains({ permissions: ["tabs"] }),
+    chrome.permissions.contains({ permissions: ["downloads"] }),
+    chrome.permissions.contains({ permissions: ["clipboardRead"] }),
+    chrome.permissions.contains({ permissions: ["clipboardWrite"] })
+  ]);
+  return { tabs, downloads, clipboardread, clipboardwrite, reportedat: Date.now() };
+}
+function stepoptions(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function tabid(step) {
+  return Number.parseInt(step.value ?? "", 10);
+}
+async function runbrowseraction(step, sessiontabid, windowid) {
+  const options = stepoptions(step);
+  switch (step.kind) {
+    case "tablist": {
+      const tabs = await chrome.tabs.query({});
+      return { ok: true, summary: `Listed ${tabs.length} open tab${tabs.length === 1 ? "" : "s"}.`, details: { tabs: tabs.map((tab) => ({ id: tab.id ?? 0, index: tab.index, title: tab.title ?? "", url: tab.url ?? "", active: tab.active, pinned: tab.pinned, audible: tab.audible ?? false })) } };
+    }
+    case "tabcreate": {
+      const created = await chrome.tabs.create({ url: step.value, active: options.active !== false, pinned: options.pinned === true });
+      return { ok: true, summary: `Opened a new tab for ${step.value}.`, details: { tabid: created?.id ?? 0 } };
+    }
+    case "tabactivate": {
+      await chrome.tabs.update(tabid(step), { active: true });
+      return { ok: true, summary: `Activated tab ${tabid(step)}.` };
+    }
+    case "tabclose": {
+      await chrome.tabs.remove(tabid(step));
+      return { ok: true, summary: `Closed tab ${tabid(step)}.` };
+    }
+    case "tabreload": {
+      await chrome.tabs.reload(tabid(step), { bypassCache: options.bypasscache === true });
+      return { ok: true, summary: `Reloaded tab ${tabid(step)}.` };
+    }
+    case "tabsnapshot": {
+      const shot = await chrome.tabs.captureVisibleTab(windowid, { format: "png" });
+      return { ok: true, summary: "Captured the visible area of the active tab.", details: { shot } };
+    }
+    case "windowlist": {
+      const windows = await chrome.windows.getAll();
+      return { ok: true, summary: `Listed ${windows.length} open window${windows.length === 1 ? "" : "s"}.`, details: { windows: windows.map((item) => ({ id: item.id ?? 0, type: item.type, state: item.state ?? "", focused: item.focused })) } };
+    }
+    case "windowcreate": {
+      const created = await chrome.windows.create({ url: step.value ?? "about:blank", ...typeof options.width === "number" ? { width: options.width } : {}, ...typeof options.height === "number" ? { height: options.height } : {} });
+      return { ok: true, summary: `Opened a new window for ${step.value}.`, details: { windowid: created?.id ?? 0 } };
+    }
+    case "windowclose": {
+      await chrome.windows.remove(tabid(step));
+      return { ok: true, summary: `Closed window ${tabid(step)}.` };
+    }
+    case "zoomset": {
+      const zoom = Number(step.value);
+      await chrome.tabs.setZoom(sessiontabid, zoom);
+      return { ok: true, summary: `Set the tab zoom to ${zoom}.` };
+    }
+    case "windowresize": {
+      await chrome.windows.update(tabid(step), { width: options.width, height: options.height });
+      return { ok: true, summary: `Resized window ${tabid(step)}.` };
+    }
+    case "downloadfile": {
+      const downloadid = await chrome.downloads.download({ url: step.value ?? "" });
+      return { ok: true, summary: `Started the download of ${step.value}.`, details: { downloadid } };
+    }
+    default:
+      return { ok: false, summary: "Unsupported browser action." };
+  }
 }
 
 // extension/background.ts
 var sessionduration = 15 * 60 * 1e3;
+var freshcheckkinds = /* @__PURE__ */ new Set(["focus", "inspect", "click", "type", "scroll", "select", "hover"]);
 var chromestorage = {
   async get(key) {
     return (await chrome.storage.local.get(key))[key];
@@ -163,6 +381,11 @@ function extensionpage(sender) {
 async function audit(kind, summary, extra = {}) {
   await memory.addaudi({ id: randomid(), kind, at: Date.now(), summary, ...extra });
 }
+async function refreshcapabilities() {
+  const report = await readcapabilities();
+  await memory.setcapabilities(report);
+  return report;
+}
 async function activecontext() {
   const [tab] = await chrome.tabs.query({ active: true, lastFocusedWindow: true });
   if (!tab?.id || !tab.url) throw new Error("No active web tab is available.");
@@ -170,9 +393,9 @@ async function activecontext() {
   if (!origin.startsWith("https://")) throw new Error("Devthink can work with HTTPS pages only.");
   return { tab, origin };
 }
-async function snapshot(tabid) {
-  await chrome.scripting.executeScript({ target: { tabId: tabid }, files: ["pagebridge.js"] });
-  const result = await chrome.scripting.executeScript({ target: { tabId: tabid }, func: () => {
+async function snapshot(tabid2) {
+  await chrome.scripting.executeScript({ target: { tabId: tabid2 }, files: ["pagebridge.js"] });
+  const result = await chrome.scripting.executeScript({ target: { tabId: tabid2 }, func: () => {
     const bridge = globalThis.devthinkbridge;
     if (!bridge) throw new Error("Devthink page bridge is unavailable.");
     return bridge.capturesnapshot();
@@ -183,7 +406,7 @@ async function snapshot(tabid) {
 }
 async function startsession() {
   const { tab, origin } = await activecontext();
-  const session = { id: randomid(), tabid: tab.id, origin, startedat: Date.now(), expiresat: Date.now() + sessionduration };
+  const session = { id: randomid(), tabid: tab.id, origin, startedat: Date.now(), expiresat: Date.now() + sessionduration, grants: [origin] };
   await memory.setsession(session);
   await audit("session", `Session started for ${origin}.`, { sessionid: session.id });
   return session;
@@ -200,7 +423,7 @@ async function diagnostic() {
 }
 function localplan(objective, session) {
   const now = Date.now();
-  return { id: randomid(), objective, origin: session.origin, steps: [{ id: randomid(), kind: "observe", summary: "Capture a bounded semantic snapshot of the approved active tab.", risk: "read" }], createdat: now, expiresat: now + sessionduration, state: "pending" };
+  return { id: randomid(), objective, origin: session.origin, steps: [{ id: randomid(), kind: "observe", summary: "Capture a complete semantic snapshot of the approved active tab.", risk: "read" }], createdat: now, expiresat: now + sessionduration, state: "pending" };
 }
 async function propose(objective, remote) {
   if (!objective.trim()) throw new Error("An objective is required.");
@@ -209,18 +432,25 @@ async function propose(objective, remote) {
   const { tab, origin } = await activecontext();
   if (session.tabid !== tab.id || session.origin !== origin) throw new Error("The selected tab or origin no longer matches the approved session.");
   const observation = await snapshot(session.tabid);
+  const capabilities = await refreshcapabilities();
   const config = await memory.getconfig();
   let plan = localplan(objective.trim(), session);
   if (remote) {
     if (!config) throw new Error("Configure an approved HTTPS endpoint before requesting a remote proposal.");
-    const response = await fetch(config.endpoint, { method: "POST", headers: { "content-type": "application/json" }, credentials: "omit", body: requestbody({ objective: objective.trim(), session, observation }) });
+    const response = await fetch(config.endpoint, { method: "POST", headers: { "content-type": "application/json" }, credentials: "omit", body: requestbody({ objective: objective.trim(), session, observation, capabilities }) });
     if (!response.ok) throw new Error(`Proposal endpoint returned ${response.status}.`);
     plan = parseproposal(await response.json(), session.origin).plan;
   }
   await memory.setplan(plan);
+  await memory.setprogress(resetforplan(await memory.getprogress(), plan, Date.now()));
   await audit("proposal", `Plan proposed with ${plan.steps.length} reviewed step${plan.steps.length === 1 ? "" : "s"}.`, { sessionid: session.id, planid: plan.id });
   return plan;
 }
+function browserauditkind(step) {
+  if (step.kind === "downloadfile") return "download";
+  if (step.kind.startsWith("window")) return "window";
+  return "tab";
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
@@ -229,16 +459,41 @@ async function executestep(stepid) {
   if (!step) throw new Error("Reviewed step was not found.");
   const gate = canexecute({ session, plan, step, tabid: tab.id, origin });
   if (!gate.allowed) throw new Error(gate.reason);
-  const fresh = await snapshot(tab.id);
-  if (step.target && !fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
-  const result = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: (action, expectedorigin) => {
-    const bridge = globalThis.devthinkbridge;
-    if (!bridge) throw new Error("Devthink page bridge is unavailable.");
-    return bridge.performstep(action, expectedorigin);
-  }, args: [step, origin] });
-  const output = result[0]?.result;
+  let output;
+  if (isbrowserkind(step.kind)) {
+    const capability = requiredcapability(step.kind);
+    if (capability) {
+      const granted = await chrome.permissions.contains({ permissions: [capability] });
+      if (!granted) throw new Error(`The ${capability} capability has not been granted; request it from the review panel.`);
+    }
+    output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
+  } else {
+    if (step.target && freshcheckkinds.has(step.kind)) {
+      const fresh = await snapshot(tab.id);
+      if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
+    }
+    const result = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: (action, expectedorigin) => {
+      const bridge = globalThis.devthinkbridge;
+      if (!bridge) throw new Error("Devthink page bridge is unavailable.");
+      return bridge.performstep(action, expectedorigin);
+    }, args: [step, origin] });
+    output = result[0]?.result;
+  }
   const summary = output?.summary ?? "The page action returned no result.";
-  await audit(output?.ok ? "action" : "error", summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
+  const outcome = { stepid, ok: Boolean(output?.ok), summary, ...output?.details ? { details: output.details } : {}, at: Date.now() };
+  const auditkind = isbrowserkind(step.kind) ? browserauditkind(step) : output?.ok ? "action" : "error";
+  await audit(auditkind, summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
+  await memory.addoutcome(outcome);
+  if (output?.ok && plan) {
+    const completed = recordstep(await memory.getprogress(), plan.id, stepid, Date.now());
+    const tracked = recordoutcome(completed, plan.id, outcome, Date.now());
+    await memory.setprogress(tracked);
+    if (iscomplete(tracked, plan) && plan.state === "approved") {
+      const done = { ...plan, state: "completed", completedat: Date.now() };
+      await memory.setplan(done);
+      await audit("complete", "Every reviewed step of the approved plan has executed.", { ...session ? { sessionid: session.id } : {}, planid: done.id });
+    }
+  }
   return output ?? { ok: false, summary };
 }
 async function previewstep(stepid) {
@@ -249,8 +504,7 @@ async function previewstep(stepid) {
   if (!step) throw new Error("Reviewed step was not found.");
   const gate = canpreview({ session, plan, step, tabid: tab.id, origin });
   if (!gate.allowed) throw new Error(gate.reason);
-  const fresh = await snapshot(tab.id);
-  if (!step.target || !fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
+  if (!step.target) throw new Error("Only a target-based step can be previewed.");
   const result = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: (target, expectedorigin) => {
     const bridge = globalThis.devthinkbridge;
     if (!bridge) throw new Error("Devthink page bridge is unavailable.");
@@ -261,6 +515,33 @@ async function previewstep(stepid) {
   await audit(output?.ok ? "observe" : "error", summary, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid });
   return output ?? { ok: false, summary };
 }
+async function pausesession() {
+  const session = await memory.getsession();
+  if (!session || session.stoppedat) throw new Error("No active browser session exists.");
+  if (session.expiresat <= Date.now()) throw new Error("The browser session has expired.");
+  if (session.pausedat) throw new Error("The browser session is already paused.");
+  const paused = { ...session, pausedat: Date.now() };
+  await memory.setsession(paused);
+  await audit("pause", "The user paused the browser session; no action or preview can run.", { sessionid: session.id });
+  return paused;
+}
+async function resumesession() {
+  const session = await memory.getsession();
+  if (!session || session.stoppedat) throw new Error("No active browser session exists.");
+  if (session.expiresat <= Date.now()) throw new Error("The browser session has expired and cannot be resumed.");
+  if (!session.pausedat) throw new Error("The browser session is not paused.");
+  const resumed = { id: session.id, tabid: session.tabid, origin: session.origin, startedat: session.startedat, expiresat: session.expiresat, ...session.grants ? { grants: session.grants } : {} };
+  await memory.setsession(resumed);
+  await audit("resume", "The user resumed the browser session; reviewed actions can run again.", { sessionid: session.id });
+  return resumed;
+}
+async function grantcapability(permission) {
+  if (!["tabs", "downloads", "clipboardRead", "clipboardWrite"].includes(permission)) throw new Error("Unknown capability.");
+  const granted = await chrome.permissions.request({ permissions: [permission] });
+  if (!granted) throw new Error("The capability grant was declined.");
+  await audit("capability", `Capability ${permission} granted by the user.`);
+  return refreshcapabilities();
+}
 async function handlerequest(message, sender) {
   if (!extensionpage(sender)) throw new Error("Requests are accepted only from Devthink extension pages.");
   const input = message;
@@ -275,8 +556,15 @@ async function handlerequest(message, sender) {
     }
     case "startsession":
       return startsession();
-    case "context":
-      return { config: await memory.getconfig(), session: await memory.getsession(), plan: await memory.getplan(), diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit() };
+    case "context": {
+      const plan = await memory.getplan();
+      const progress = await memory.getprogress();
+      return { config: await memory.getconfig(), session: await memory.getsession(), plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes() };
+    }
+    case "capabilities":
+      return refreshcapabilities();
+    case "grantcapability":
+      return grantcapability(input.permission ?? "");
     case "diagnostic":
       return diagnostic();
     case "proposelocal":
@@ -305,6 +593,10 @@ async function handlerequest(message, sender) {
       return previewstep(input.stepid ?? "");
     case "execute":
       return executestep(input.stepid ?? "");
+    case "pausesession":
+      return pausesession();
+    case "resumesession":
+      return resumesession();
     case "stop": {
       const session = await memory.getsession();
       if (session) await memory.setsession({ ...session, stoppedat: Date.now() });