npm - @wenathlan/extension - Versions diffs - 1.1.34 → 1.1.35 - Mend

@wenathlan/extension 1.1.34 → 1.1.35

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (25) hide show

package/README.md +5 -4
package/dist/index.js +315 -4
package/dist/index.js.map +2 -2
package/dist/memory.d.ts +53 -1
package/dist/memory.d.ts.map +1 -1
package/dist/policy.d.ts +8 -1
package/dist/policy.d.ts.map +1 -1
package/dist/protocol.d.ts +23 -1
package/dist/protocol.d.ts.map +1 -1
package/dist/types.d.ts +146 -3
package/dist/types.d.ts.map +1 -1
package/dist/version.d.ts +1 -1
package/extension/dist/background.js +1164 -11
package/extension/dist/background.js.map +4 -4
package/extension/dist/manifest.json +1 -1
package/extension/dist/pagebridge.js +331 -12
package/extension/dist/pagebridge.js.map +4 -4
package/extension/dist/popup.html +1 -1
package/extension/dist/popup.js +12 -2
package/extension/dist/popup.js.map +2 -2
package/extension/dist/sidepanel.html +1 -1
package/extension/dist/sidepanel.js +189 -8
package/extension/dist/sidepanel.js.map +3 -3
package/extension/manifest.json +1 -1
package/package.json +1 -1

package/extension/dist/popup.html CHANGED Viewed

@@ -1,5 +1,5 @@
 <!doctype html>
 <html lang="en">
 <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Devthink</title><link rel="stylesheet" href="style.css"></head>
-<body><main><header><p class="eyebrow">DEVTHINK 1.1.34</p><h1>Browser bridge</h1><p>Consent is required before page access or action.</p></header><label for="endpoint">Optional agent endpoint</label><input id="endpoint" type="url" inputmode="url" placeholder="https://agent.example/proposal" autocomplete="off"><button id="connect">Approve endpoint origin</button><div class="actions"><button id="session">Start active tab session</button><button id="pause" class="secondary">Pause session</button><button id="openpanel" class="secondary">Review plans</button><button id="stop" class="danger">Stop</button></div><p id="capabilities" role="status" class="muted">Optional capabilities: loading.</p><p id="livelogic" role="status" class="muted">Held keys: none · Open dialogs answered: none.</p><p id="status" role="status">Loading session state.</p></main><script type="module" src="popup.js"></script></body>
+<body><main><header><p class="eyebrow">DEVTHINK 1.1.35</p><h1>Browser bridge</h1><p>Consent is required before page access or action.</p></header><label for="endpoint">Optional agent endpoint</label><input id="endpoint" type="url" inputmode="url" placeholder="https://agent.example/proposal" autocomplete="off"><button id="connect">Approve endpoint origin</button><div class="actions"><button id="session">Start active tab session</button><button id="pause" class="secondary">Pause session</button><button id="openpanel" class="secondary">Review plans</button><button id="stop" class="danger">Stop</button></div><p id="capabilities" role="status" class="muted">Optional capabilities: loading.</p><p id="livelogic" role="status" class="muted">Held keys: none · Open dialogs answered: none.</p><p id="navstate" role="status" class="muted">Navigation: unknown.</p><p id="status" role="status">Loading session state.</p></main><script type="module" src="popup.js"></script></body>
 </html>

package/extension/dist/popup.js CHANGED Viewed

@@ -1,7 +1,7 @@
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 function normalizeendpoint(value) {
   const endpoint = new URL(value.trim());
@@ -20,6 +20,7 @@ var endpointinput = document.querySelector("#endpoint");
 var statusnode = document.querySelector("#status");
 var capabilitiesnode = document.querySelector("#capabilities");
 var livenode = document.querySelector("#livelogic");
+var navstatenode = document.querySelector("#navstate");
 var connectbutton = document.querySelector("#connect");
 var sessionbutton = document.querySelector("#session");
 var pausebutton = document.querySelector("#pause");
@@ -56,11 +57,20 @@ function renderlivestate(holds, dialogs, signals) {
   const pages = signals && (signals.language !== void 0 || signals.template !== void 0 || signals.scrolllocked !== void 0) ? [signals.language !== void 0 ? `language ${signals.language || "unknown"}` : "", signals.template !== void 0 ? `template ${signals.template}` : "", signals.scrolllocked !== void 0 ? `scroll lock ${signals.scrolllocked ? "on" : "off"}` : ""].filter(Boolean).join(" \xB7 ") : "unknown";
   livenode.textContent = `Held keys: ${heldsummary} \xB7 Open dialogs answered: ${dialogsummary} \xB7 Page signals: ${pages}.`;
 }
+function rendernavstate(state, offline, profile, queues) {
+  if (!navstatenode) return;
+  const phase = state?.phase ? `load phase ${state.phase}` : "load phase unknown";
+  const offlinestate = offline === void 0 ? "connectivity unknown" : offline ? "offline" : "online";
+  const wait = profile ? `wait profile ${profile.profile.signals.join("+")}` : "no wait profile";
+  const queued = queues ? `queued targets ${queues.prefetch + queues.batchopen} (${queues.prefetch} prefetch \xB7 ${queues.batchopen} batch open)` : "no queued targets";
+  navstatenode.textContent = `Navigation: ${phase} \xB7 ${offlinestate} \xB7 ${wait} \xB7 ${queued}.`;
+}
 async function restore() {
   const context = await request({ kind: "context" });
   if (endpointinput && context.config) endpointinput.value = context.config.endpoint;
   rendercapabilities(context.capabilities);
   renderlivestate(context.holds?.heldkeys, context.dialogs, context.signals);
+  rendernavstate(context.navstate, context.offline, context.waitprofile, context.navqueues);
   const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
   if (pausebutton) {
     pausebutton.disabled = !active;

package/extension/dist/popup.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../policy.ts", "../popup.ts"],
-  "sourcesContent": ["import type { actionkind, agentplan, agentsession, endpointconfig, observationmode, policyevaluation, toolstep } from \"./types.js\";\n\nconst sensitiveactions = new Set<actionkind>([\"click\", \"type\", \"navigate\", \"select\", \"presskey\", \"drag\", \"drop\", \"upload\", \"clear\", \"check\", \"uncheck\", \"toggle\", \"submit\", \"reload\", \"back\", \"forward\", \"writestorage\", \"setattribute\", \"removeattribute\", \"evaluate\", \"tabcreate\", \"tabactivate\", \"tabclose\", \"tabreload\", \"windowcreate\", \"windowclose\", \"windowresize\", \"downloadfile\", \"clickpoint\", \"shiftclick\", \"dismissdialog\", \"enterframe\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"keyhold\", \"keyrelease\", \"submitsearch\", \"selectmulti\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\"]);\nconst interactionactions = new Set<actionkind>([\"focus\", \"scroll\", \"hover\", \"clickdeep\", \"rightclick\", \"doubleclick\", \"scrollpage\", \"scrollby\", \"scrollend\", \"scrolltop\", \"fullscreen\", \"zoomset\", \"movepointer\", \"clicktext\", \"clickaria\", \"clickname\", \"expanddetails\", \"pierceshadow\", \"retryaction\"]);\nconst readactions = new Set<actionkind>([\"observe\", \"inspect\", \"extract\", \"wait\", \"waitfor\", \"waittext\", \"readattribute\", \"readstyle\", \"readgeometry\", \"readvalue\", \"readtext\", \"readhtml\", \"countelements\", \"readtable\", \"readlinks\", \"readimages\", \"readmeta\", \"readforms\", \"readstorage\", \"highlight\", \"tablist\", \"windowlist\", \"tabsnapshot\", \"mapclicks\", \"verifyvisible\", \"verifyenabled\", \"resolvexpath\", \"a11ytree\", \"readvisible\", \"readertree\", \"detectlists\", \"detecttables\", \"readjson\", \"watchmutate\", \"waitquiet\", \"watchbanner\", \"detectinfinitescroll\", \"detectvirtual\", \"detectlazy\", \"readscrollpos\", \"readlang\", \"readoutline\", \"countpages\", \"listshadow\", \"listframes\", \"classifypage\", \"fingerprintsection\", \"diffsnapshots\", \"readselection\", \"watchfocus\", \"detectsticky\", \"detectscrolllock\", \"readopengraph\", \"detectlanguage\", \"deriveselector\"]);\nconst allowedactions = new Set<actionkind>([...sensitiveactions, ...interactionactions, ...readactions]);\nconst watchactions = new Set<actionkind>([\"watchmutate\", \"watchbanner\", \"watchfocus\"]);\nconst targetactions = new Set<actionkind>([\"inspect\", \"focus\", \"click\", \"type\", \"scroll\", \"select\", \"hover\", \"clickdeep\", \"rightclick\", \"doubleclick\", \"drag\", \"drop\", \"upload\", \"clear\", \"check\", \"uncheck\", \"toggle\", \"submit\", \"readattribute\", \"readstyle\", \"readgeometry\", \"readvalue\", \"readtext\", \"readhtml\", \"countelements\", \"readtable\", \"highlight\", \"setattribute\", \"removeattribute\", \"waitfor\", \"shiftclick\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"submitsearch\", \"selectmulti\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\", \"expanddetails\", \"verifyvisible\", \"verifyenabled\", \"pierceshadow\", \"deriveselector\", \"fingerprintsection\"]);\nconst valueactions = new Set<actionkind>([\"presskey\", \"drag\", \"drop\", \"upload\", \"readattribute\", \"removeattribute\", \"waittext\", \"evaluate\", \"zoomset\", \"tabactivate\", \"tabclose\", \"tabreload\", \"windowclose\", \"windowresize\", \"tabcreate\", \"windowcreate\", \"downloadfile\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"keyhold\", \"keyrelease\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\"]);\n\n/** Normalizes a user supplied HTTPS endpoint without preserving a provider lock-in. */\nexport function normalizeendpoint(value: string): endpointconfig {\n  const endpoint = new URL(value.trim());\n  if (endpoint.protocol !== \"https:\") throw new Error(\"Devthink accepts HTTPS endpoints only.\");\n  if (endpoint.username || endpoint.password) throw new Error(\"Endpoint credentials are not allowed in the URL.\");\n  return { endpoint: endpoint.toString(), origin: endpoint.origin, configuredat: Date.now() };\n}\n\n/** Creates the exact optional host pattern requested from Chromium. */\nexport function hostpattern(origin: string): string {\n  const parsed = new URL(origin);\n  if (parsed.protocol !== \"https:\") throw new Error(\"Only HTTPS origins can be granted.\");\n  return `${parsed.origin}/*`;\n}\n\n/** True when the action kind observes the page over a reviewed lifetime window. */\nexport function iswatchkind(kind: actionkind): boolean {\n  return watchactions.has(kind);\n}\n\n/** Grades the observation mode of a kind: passive capture, watched lifetimes or diffing passes. */\nexport function observationmodeof(kind: actionkind): observationmode {\n  if (watchactions.has(kind) || kind === \"waitquiet\") return \"watching\";\n  if (kind === \"diffsnapshots\") return \"diffing\";\n  return \"passive\";\n}\n\n/** Defines action risk from the fixed local allowlist. */\nexport function actionrisk(kind: actionkind): \"read\" | \"interaction\" | \"sensitive\" {\n  if (!allowedactions.has(kind)) throw new Error(\"Unsupported browser action.\");\n  if (sensitiveactions.has(kind)) return \"sensitive\";\n  return interactionactions.has(kind) ? \"interaction\" : \"read\";\n}\n\n/** True when the action kind accepts a css selector target or a reviewed targetref. */\nexport function needstarget(kind: actionkind): boolean {\n  return targetactions.has(kind);\n}\n\n/** Parses the reviewed JSON options of a step; malformed payloads are rejected early. */\nexport function parseoptions(step: toolstep): Record<string, unknown> {\n  if (step.options === undefined) return {};\n  let parsed: unknown;\n  try { parsed = JSON.parse(step.options); } catch { throw new Error(\"Step options must be a JSON object.\"); }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new Error(\"Step options must be a JSON object.\");\n  return parsed as Record<string, unknown>;\n}\n\n/** Maps an action kind to the optional browser permission it requires, if any. */\nexport function requiredcapability(kind: actionkind): string | undefined {\n  if (kind === \"tablist\") return \"tabs\";\n  if (kind === \"downloadfile\") return \"downloads\";\n  return undefined;\n}\n\n/** Parses the reviewed wait duration of a wait step with no upper bound. */\nexport function waitduration(step: toolstep): number {\n  const requested = step.value ? Number.parseInt(step.value, 10) : 250;\n  if (!Number.isFinite(requested) || requested < 0) throw new Error(\"Wait duration must be zero or a positive number of milliseconds.\");\n  return requested;\n}\n\nfunction isnumericid(value: unknown): value is string {\n  return typeof value === \"string\" && /^\\d+$/.test(value);\n}\n\nfunction numericoption(options: Record<string, unknown>, key: string): boolean {\n  return options[key] === undefined || (typeof options[key] === \"number\" && Number.isFinite(options[key] as number));\n}\n\n/** True when an optional numeric option is absent or a finite number of zero or more. */\nfunction nonnegativeoption(options: Record<string, unknown>, key: string): boolean {\n  return numericoption(options, key) && !(typeof options[key] === \"number\" && (options[key] as number) < 0);\n}\n\nfunction isnonempty(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction ispoint(value: unknown): boolean {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const point = value as Record<string, unknown>;\n  return typeof point.x === \"number\" && Number.isFinite(point.x) && typeof point.y === \"number\" && Number.isFinite(point.y);\n}\n\n/** Grades a resolution match count: zero is absent, one is resolved and more than one is refused as ambiguous. */\nexport function resolutionverdict(count: number): \"absent\" | \"resolved\" | \"ambiguous\" {\n  if (!Number.isFinite(count) || count <= 0) return \"absent\";\n  return count === 1 ? \"resolved\" : \"ambiguous\";\n}\n\n/** Validates the reviewed targetref grammar of every resolution mode and rejects empty references. */\nexport function validatetargetref(reference: unknown): policyevaluation {\n  if (!reference || typeof reference !== \"object\" || Array.isArray(reference)) return { allowed: false, reason: \"The reviewed target reference must be an object.\" };\n  const ref = reference as Record<string, unknown>;\n  if (ref.mode === \"selector\") return isnonempty(ref.selector) ? { allowed: true } : { allowed: false, reason: \"The selector target reference needs a non-empty selector.\" };\n  if (ref.mode === \"text\") return isnonempty(ref.text) ? { allowed: true } : { allowed: false, reason: \"The text target reference needs non-empty text.\" };\n  if (ref.mode === \"aria\") {\n    if (!isnonempty(ref.role)) return { allowed: false, reason: \"The aria target reference needs a non-empty role.\" };\n    return isnonempty(ref.name) ? { allowed: true } : { allowed: false, reason: \"The aria target reference needs a non-empty name.\" };\n  }\n  if (ref.mode === \"name\") return isnonempty(ref.name) ? { allowed: true } : { allowed: false, reason: \"The name target reference needs a non-empty name.\" };\n  if (ref.mode === \"xpath\") return isnonempty(ref.xpath) ? { allowed: true } : { allowed: false, reason: \"The xpath target reference needs a non-empty expression.\" };\n  if (ref.mode === \"index\") {\n    const index = ref.index;\n    return typeof index === \"number\" && Number.isInteger(index) && index >= 1 ? { allowed: true } : { allowed: false, reason: \"The index target reference needs a positive integer map number.\" };\n  }\n  if (ref.mode === \"point\") {\n    const pointok = typeof ref.x === \"number\" && Number.isFinite(ref.x) && typeof ref.y === \"number\" && Number.isFinite(ref.y);\n    return pointok ? { allowed: true } : { allowed: false, reason: \"The point target reference needs numeric x and y coordinates.\" };\n  }\n  return { allowed: false, reason: \"The target reference mode must be selector, text, aria, name, xpath, index or point.\" };\n}\n\n/** True when the session origin grants cover the given origin; a session without grants only allows its own origin. */\nexport function origingranted(session: agentsession | undefined, origin: string): boolean {\n  if (!session) return false;\n  const grants = session.grants ?? [session.origin];\n  return grants.includes(origin);\n}\n\n/** Validates the reviewed inner step of a retry or frame wrapper against the same rules as a top-level step. */\nfunction validateinnerstep(options: Record<string, unknown>, origin: string): policyevaluation {\n  const stepid = options.stepid;\n  const kind = options.kind;\n  if (isnonempty(stepid)) {\n    if (kind !== undefined) return { allowed: false, reason: \"The reviewed wrapper must reference a step id or an inline step, not both.\" };\n    return { allowed: true };\n  }\n  if (typeof kind !== \"string\" || !kind.trim()) return { allowed: false, reason: \"A reviewed step id or inline step kind is required in options.\" };\n  if (kind === \"retryaction\" || kind === \"enterframe\") return { allowed: false, reason: \"The reviewed inner step cannot be another wrapper kind.\" };\n  if (!allowedactions.has(kind as actionkind)) return { allowed: false, reason: \"The reviewed inner step kind is unsupported.\" };\n  const inneroptions = options.options;\n  if (inneroptions !== undefined && (!inneroptions || typeof inneroptions !== \"object\" || Array.isArray(inneroptions))) return { allowed: false, reason: \"The reviewed inner step options must be an object.\" };\n  const inner: toolstep = {\n    id: \"inner\",\n    kind: kind as actionkind,\n    summary: \"Reviewed inner step.\",\n    risk: actionrisk(kind as actionkind),\n    ...(isnonempty(options.target) ? { target: options.target } : {}),\n    ...(isnonempty(options.value) ? { value: options.value } : {}),\n    ...(inneroptions !== undefined ? { options: JSON.stringify(inneroptions) } : {}),\n  };\n  return validatestep(inner, origin);\n}\n\n/** Validates a single proposal against the active tab origin and local policy. */\nexport function validatestep(step: toolstep, origin: string): policyevaluation {\n  if (!allowedactions.has(step.kind)) return { allowed: false, reason: \"Unsupported action kind.\" };\n  if (!step.summary.trim()) return { allowed: false, reason: \"A human-readable action summary is required.\" };\n  let options: Record<string, unknown>;\n  try { options = parseoptions(step); } catch { return { allowed: false, reason: \"Step options must be a JSON object.\" }; }\n  const hastargetref = options.targetref !== undefined;\n  if (targetactions.has(step.kind) && !step.target?.trim() && !hastargetref) return { allowed: false, reason: \"A page target is required.\" };\n  if (valueactions.has(step.kind) && !step.value?.trim()) return { allowed: false, reason: \"A reviewed value is required.\" };\n  if (step.kind === \"select\" && !step.value?.trim()) return { allowed: false, reason: \"A reviewed option value is required.\" };\n  if (step.kind === \"navigate\" && !step.value) return { allowed: false, reason: \"A navigation URL is required.\" };\n  if (hastargetref) {\n    const reference = validatetargetref(options.targetref);\n    if (!reference.allowed) return reference;\n  }\n  if (step.kind === \"wait\") {\n    try { waitduration(step); } catch { return { allowed: false, reason: \"Wait duration must be zero or a positive number of milliseconds.\" }; }\n  }\n  if (step.kind === \"navigate\") {\n    try {\n      if (new URL(step.value ?? \"\").origin !== origin) return { allowed: false, reason: \"Navigation must remain within the approved origin.\" };\n    } catch {\n      return { allowed: false, reason: \"Navigation URL is invalid.\" };\n    }\n  }\n  if (step.kind === \"tabcreate\" || step.kind === \"windowcreate\" || step.kind === \"downloadfile\") {\n    try {\n      const url = new URL(step.value ?? \"\");\n      if (url.protocol !== \"https:\") return { allowed: false, reason: \"The reviewed URL must use HTTPS.\" };\n    } catch {\n      return { allowed: false, reason: \"The reviewed URL is invalid.\" };\n    }\n  }\n  if (step.kind === \"tabactivate\" || step.kind === \"tabclose\" || step.kind === \"tabreload\" || step.kind === \"windowclose\" || step.kind === \"windowresize\") {\n    if (!isnumericid(step.value)) return { allowed: false, reason: \"A numeric browser id is required.\" };\n  }\n  if (step.kind === \"zoomset\") {\n    const zoom = Number(step.value);\n    if (!Number.isFinite(zoom) || zoom <= 0) return { allowed: false, reason: \"The reviewed zoom must be a positive number.\" };\n  }\n  if (step.kind === \"setattribute\" || step.kind === \"writestorage\") {\n    const keyname = step.kind === \"setattribute\" ? \"name\" : \"key\";\n    if (typeof options[keyname] !== \"string\" || !(options[keyname] as string).trim()) return { allowed: false, reason: `A reviewed ${keyname} is required in options.` };\n    if (typeof options.value !== \"string\") return { allowed: false, reason: \"A reviewed value is required in options.\" };\n  }\n  if (step.kind === \"windowresize\") {\n    if (typeof options.width !== \"number\" || typeof options.height !== \"number\" || !Number.isFinite(options.width) || !Number.isFinite(options.height)) return { allowed: false, reason: \"Reviewed width and height numbers are required in options.\" };\n  }\n  if ((step.kind === \"scrollpage\" || step.kind === \"scrollby\") && (!numericoption(options, \"x\") || !numericoption(options, \"y\"))) return { allowed: false, reason: \"Scroll amounts must be numbers in options.\" };\n  if (step.kind === \"waitfor\" && options.timeout !== undefined && (typeof options.timeout !== \"number\" || options.timeout < 0)) return { allowed: false, reason: \"The waitfor timeout must be zero or a positive number of milliseconds.\" };\n  if (step.kind === \"movepointer\") {\n    const path = options.pointpath;\n    if (!path || typeof path !== \"object\" || Array.isArray(path)) return { allowed: false, reason: \"A reviewed pointpath with start and end points is required in options.\" };\n    const points = path as Record<string, unknown>;\n    if (!ispoint(points.start) || !ispoint(points.end)) return { allowed: false, reason: \"The reviewed pointpath needs numeric start and end points.\" };\n    if (points.waypoints !== undefined && (!Array.isArray(points.waypoints) || !points.waypoints.every(waypoint => ispoint(waypoint)))) return { allowed: false, reason: \"The reviewed pointpath waypoints must be numeric points.\" };\n    if (!nonnegativeoption(points, \"duration\")) return { allowed: false, reason: \"The reviewed pointpath duration must be zero or a positive number of milliseconds.\" };\n    const speed = options.speedprofile;\n    if (speed !== undefined) {\n      if (!speed || typeof speed !== \"object\" || Array.isArray(speed)) return { allowed: false, reason: \"The reviewed speed profile must be an object.\" };\n      const profile = speed as Record<string, unknown>;\n      if (profile.easing !== undefined && profile.easing !== \"linear\" && profile.easing !== \"easeinout\") return { allowed: false, reason: \"The reviewed easing must be linear or easeinout.\" };\n      if (!nonnegativeoption(profile, \"peak\")) return { allowed: false, reason: \"The reviewed peak velocity must be zero or a positive number.\" };\n      if (!nonnegativeoption(profile, \"jitter\")) return { allowed: false, reason: \"The reviewed jitter window must be zero or a positive number of milliseconds.\" };\n    }\n  }\n  if (step.kind === \"clickpoint\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"point\")) return { allowed: false, reason: \"A reviewed point target reference is required in options.\" };\n  if (step.kind === \"clicktext\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"text\")) return { allowed: false, reason: \"A reviewed text target reference is required in options.\" };\n  if (step.kind === \"clickaria\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"aria\")) return { allowed: false, reason: \"A reviewed aria target reference is required in options.\" };\n  if (step.kind === \"clickname\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"name\")) return { allowed: false, reason: \"A reviewed name target reference is required in options.\" };\n  if (step.kind === \"resolvexpath\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"xpath\")) return { allowed: false, reason: \"A reviewed xpath target reference is required in options.\" };\n  if (step.kind === \"typetime\" && options.delay !== undefined && (typeof options.delay !== \"number\" || !Number.isFinite(options.delay) || options.delay < 0)) return { allowed: false, reason: \"The reviewed per keystroke delay must be zero or a positive number of milliseconds.\" };\n  if (step.kind === \"submitsearch\") {\n    if (!isnonempty(options.results)) return { allowed: false, reason: \"A reviewed results region selector is required in options.\" };\n    if (options.timeout !== undefined && (typeof options.timeout !== \"number\" || !Number.isFinite(options.timeout) || options.timeout < 0)) return { allowed: false, reason: \"The submitsearch timeout must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"selectmulti\") {\n    const values = options.values;\n    if (!Array.isArray(values) || values.length === 0 || !values.every(value => isnonempty(value))) return { allowed: false, reason: \"A reviewed list of option values is required in options.\" };\n  }\n  if (step.kind === \"setslider\") {\n    const slider = Number(step.value);\n    if (!Number.isFinite(slider)) return { allowed: false, reason: \"The reviewed slider value must be a number.\" };\n  }\n  if (step.kind === \"setdate\" && !/^\\d{4}-\\d{2}-\\d{2}$/.test(step.value ?? \"\")) return { allowed: false, reason: \"The reviewed date must use the yyyy-mm-dd form.\" };\n  if (step.kind === \"setcolor\" && !/^#[0-9a-fA-F]{6}$/.test(step.value ?? \"\")) return { allowed: false, reason: \"The reviewed color must use the #rrggbb form.\" };\n  if (step.kind === \"keyhold\" && options.holdid !== undefined && !isnonempty(options.holdid)) return { allowed: false, reason: \"The reviewed hold id must be a non-empty string.\" };\n  if (step.kind === \"dismissdialog\") {\n    const accept = options.accept;\n    const answer = options.answer;\n    if (accept === undefined && !isnonempty(answer)) return { allowed: false, reason: \"A reviewed accept flag or prompt answer is required in options.\" };\n    if (accept !== undefined && typeof accept !== \"boolean\") return { allowed: false, reason: \"The reviewed dialog accept flag must be a boolean.\" };\n    if (answer !== undefined && !isnonempty(answer)) return { allowed: false, reason: \"The reviewed prompt answer must be a non-empty string.\" };\n  }\n  if (step.kind === \"pierceshadow\" && options.shadow !== undefined) {\n    if (!Array.isArray(options.shadow) || !options.shadow.every(item => isnonempty(item))) return { allowed: false, reason: \"The reviewed shadow path must be a list of non-empty selectors.\" };\n  }\n  if (step.kind === \"enterframe\") {\n    const path = options.framepath;\n    if (!Array.isArray(path) || path.length === 0 || !path.every(item => typeof item === \"number\" && Number.isInteger(item) && item >= 0)) return { allowed: false, reason: \"A reviewed frame path of frame indexes is required in options.\" };\n    return validateinnerstep(options, origin);\n  }\n  if (step.kind === \"retryaction\") {\n    const inner = validateinnerstep(options, origin);\n    if (!inner.allowed) return inner;\n    const rule = options.retryrule;\n    if (!rule || typeof rule !== \"object\" || Array.isArray(rule)) return { allowed: false, reason: \"A reviewed retry rule with attempts is required in options.\" };\n    const retry = rule as Record<string, unknown>;\n    if (typeof retry.attempts !== \"number\" || !Number.isInteger(retry.attempts) || retry.attempts < 1) return { allowed: false, reason: \"The reviewed retry attempts must be a positive integer with no code ceiling.\" };\n    if (!nonnegativeoption(retry, \"settle\")) return { allowed: false, reason: \"The reviewed retry settle window must be zero or a positive number of milliseconds.\" };\n    if (!nonnegativeoption(retry, \"tolerance\")) return { allowed: false, reason: \"The reviewed retry movement tolerance must be zero or a positive number of pixels.\" };\n  }\n  if (watchactions.has(step.kind)) {\n    if (typeof options.lifetime !== \"number\" || !Number.isFinite(options.lifetime) || options.lifetime <= 0) return { allowed: false, reason: \"A reviewed watch lifetime window in milliseconds is required in options.\" };\n    if (options.scopes !== undefined && (!Array.isArray(options.scopes) || !options.scopes.every(scope => isnonempty(scope)))) return { allowed: false, reason: \"The reviewed watch scopes must be a list of non-empty selectors.\" };\n    if (options.events !== undefined && (!Array.isArray(options.events) || !options.events.every(event => isnonempty(event)))) return { allowed: false, reason: \"The reviewed watch event kinds must be a list of non-empty strings.\" };\n    if (!nonnegativeoption(options, \"poll\")) return { allowed: false, reason: \"The reviewed watch poll interval must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"waitquiet\") {\n    const rule = options.quietrule;\n    if (!rule || typeof rule !== \"object\" || Array.isArray(rule)) return { allowed: false, reason: \"A reviewed quietrule with an idle threshold is required in options.\" };\n    const quiet = rule as Record<string, unknown>;\n    if (typeof quiet.idle !== \"number\" || !Number.isFinite(quiet.idle) || quiet.idle <= 0) return { allowed: false, reason: \"The reviewed quiet idle threshold must be a positive number of milliseconds with no code ceiling.\" };\n    if (!nonnegativeoption(quiet, \"poll\")) return { allowed: false, reason: \"The reviewed quiet poll interval must be zero or a positive number of milliseconds.\" };\n    if (!nonnegativeoption(quiet, \"timeout\")) return { allowed: false, reason: \"The reviewed quiet timeout must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"diffsnapshots\") {\n    const versions = options.versions;\n    if (!Array.isArray(versions) || versions.length !== 2 || !versions.every(version => typeof version === \"number\" && Number.isInteger(version) && version >= 1)) return { allowed: false, reason: \"Two reviewed observation version numbers are required in options.\" };\n  }\n  return { allowed: true };\n}\n\n/** Shared session gate: a live, unpaused session that still matches the active tab. */\nfunction sessiongate(input: { session: agentsession | undefined; tabid: number; origin: string; now: number; action: string }): policyevaluation {\n  if (!input.session || input.session.stoppedat) return { allowed: false, reason: \"No active browser session exists.\" };\n  if (input.session.expiresat <= input.now) return { allowed: false, reason: \"The browser session has expired.\" };\n  if (input.session.pausedat) return { allowed: false, reason: `The browser session is paused and cannot ${input.action}.` };\n  if (input.session.tabid !== input.tabid || input.session.origin !== input.origin) return { allowed: false, reason: `The ${input.action} is outside the approved tab or origin.` };\n  return { allowed: true };\n}\n\n/** Applies the consent gate immediately before an action reaches the page bridge. */\nexport function canexecute(input: { session: agentsession | undefined; plan: agentplan | undefined; step: toolstep; tabid: number; origin: string; now?: number }): policyevaluation {\n  const now = input.now ?? Date.now();\n  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: \"execute an action\" });\n  if (!gate.allowed) return gate;\n  if (!input.plan || input.plan.state !== \"approved\") return { allowed: false, reason: \"The plan has not received explicit approval.\" };\n  if (input.plan.expiresat <= now) return { allowed: false, reason: \"The approved plan has expired.\" };\n  if ((input.step.kind === \"pierceshadow\" || input.step.kind === \"enterframe\") && !origingranted(input.session, input.origin)) return { allowed: false, reason: \"The shadow or frame step is outside the session origin grants.\" };\n  if (input.step.kind === \"readjson\" && !origingranted(input.session, input.origin)) return { allowed: false, reason: \"The json state read is outside the session origin grants.\" };\n  return validatestep(input.step, input.origin);\n}\n\n/** Allows a non-mutating, temporary target preview during plan review. */\nexport function canpreview(input: { session: agentsession | undefined; plan: agentplan | undefined; step: toolstep; tabid: number; origin: string; now?: number }): policyevaluation {\n  const now = input.now ?? Date.now();\n  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: \"preview a target\" });\n  if (!gate.allowed) return gate;\n  if (!input.plan || ![\"pending\", \"approved\"].includes(input.plan.state)) return { allowed: false, reason: \"Only a reviewed pending or approved plan can be previewed.\" };\n  if (input.plan.expiresat <= now) return { allowed: false, reason: \"The reviewed plan has expired.\" };\n  let options: Record<string, unknown> = {};\n  try { options = parseoptions(input.step); } catch { options = {}; }\n  if (!targetactions.has(input.step.kind) && options.targetref === undefined) return { allowed: false, reason: \"Only a target-based action can be previewed.\" };\n  return validatestep(input.step, input.origin);\n}\n", "import { hostpattern, normalizeendpoint } from \"../policy.js\";\nimport type { capabilityreport, dialogdecision, keyholdstate } from \"../types.js\";\n\ntype pagesignallike = { language?: string; template?: string; scrolllocked?: boolean; banner?: string };\n\nconst endpointinput = document.querySelector<HTMLInputElement>(\"#endpoint\");\nconst statusnode = document.querySelector<HTMLElement>(\"#status\");\nconst capabilitiesnode = document.querySelector<HTMLElement>(\"#capabilities\");\nconst livenode = document.querySelector<HTMLElement>(\"#livelogic\");\nconst connectbutton = document.querySelector<HTMLButtonElement>(\"#connect\");\nconst sessionbutton = document.querySelector<HTMLButtonElement>(\"#session\");\nconst pausebutton = document.querySelector<HTMLButtonElement>(\"#pause\");\nconst stopbutton = document.querySelector<HTMLButtonElement>(\"#stop\");\nconst openbutton = document.querySelector<HTMLButtonElement>(\"#openpanel\");\n\nfunction status(message: string, error = false): void { if (statusnode) { statusnode.textContent = message; statusnode.dataset.state = error ? \"error\" : \"ready\"; } }\nasync function request(message: unknown): Promise<unknown> { const response = await chrome.runtime.sendMessage(message) as { ok: boolean; value?: unknown; error?: string }; if (!response.ok) throw new Error(response.error); return response.value; }\n\nfunction pauselabel(paused: boolean): string { return paused ? \"Resume session\" : \"Pause session\"; }\n\n/** Renders the live optional capability set the user has granted. */\nfunction rendercapabilities(report?: capabilityreport): void {\n  if (!capabilitiesnode) return;\n  if (!report) { capabilitiesnode.textContent = \"Capabilities unknown.\"; return; }\n  const granted = [`tabs ${report.tabs ? \"granted\" : \"absent\"}`, `downloads ${report.downloads ? \"granted\" : \"absent\"}`, `clipboard read ${report.clipboardread ? \"granted\" : \"absent\"}`, `clipboard write ${report.clipboardwrite ? \"granted\" : \"absent\"}`];\n  capabilitiesnode.textContent = `Optional capabilities: ${granted.join(\" \u00B7 \")}.`;\n}\n\n/** Renders the currently held keys and the dialogs answered by the reviewed policy. */\nfunction renderlivestate(holds?: keyholdstate[], dialogs?: dialogdecision[], signals?: pagesignallike): void {\n  if (!livenode) return;\n  const held = (holds ?? []).filter(hold => hold.releasedat === undefined);\n  const heldsummary = held.length > 0 ? held.map(hold => `${hold.key}${hold.holdid ? ` (${hold.holdid})` : \"\"}`).join(\", \") : \"none\";\n  const dialogsummary = (dialogs ?? []).length > 0 ? `${dialogs?.length} answered` : \"none\";\n  const pages = signals && (signals.language !== undefined || signals.template !== undefined || signals.scrolllocked !== undefined)\n    ? [signals.language !== undefined ? `language ${signals.language || \"unknown\"}` : \"\", signals.template !== undefined ? `template ${signals.template}` : \"\", signals.scrolllocked !== undefined ? `scroll lock ${signals.scrolllocked ? \"on\" : \"off\"}` : \"\"].filter(Boolean).join(\" \u00B7 \")\n    : \"unknown\";\n  livenode.textContent = `Held keys: ${heldsummary} \u00B7 Open dialogs answered: ${dialogsummary} \u00B7 Page signals: ${pages}.`;\n}\n\nasync function restore(): Promise<void> {\n  const context = await request({ kind: \"context\" }) as { config?: { endpoint: string }; session?: { stoppedat?: number; pausedat?: number; expiresat: number }; capabilities?: capabilityreport; holds?: { heldkeys: keyholdstate[] }; dialogs?: dialogdecision[]; signals?: pagesignallike };\n  if (endpointinput && context.config) endpointinput.value = context.config.endpoint;\n  rendercapabilities(context.capabilities);\n  renderlivestate(context.holds?.heldkeys, context.dialogs, context.signals);\n  const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();\n  if (pausebutton) { pausebutton.disabled = !active; pausebutton.textContent = pauselabel(Boolean(context.session?.pausedat)); }\n  if (active && context.session?.pausedat) status(\"Session paused. Reviewed actions are blocked until resume.\");\n  else status(active ? \"Session active. Review the plan in the side panel.\" : \"No active browser session.\");\n}\n\nconnectbutton?.addEventListener(\"click\", async () => {\n  try {\n    const config = normalizeendpoint(endpointinput?.value ?? \"\");\n    const granted = await chrome.permissions.request({ origins: [hostpattern(config.origin)] });\n    if (!granted) throw new Error(\"Origin permission was not granted.\");\n    await request({ kind: \"configure\", endpoint: config.endpoint });\n    status(`Endpoint approved for ${config.origin}.`);\n  } catch (error) { status(error instanceof Error ? error.message : String(error), true); }\n});\nsessionbutton?.addEventListener(\"click\", async () => { try { await request({ kind: \"startsession\" }); status(\"Session started for the active HTTPS tab.\"); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\npausebutton?.addEventListener(\"click\", async () => { try { const context = await request({ kind: \"context\" }) as { session?: { pausedat?: number } }; await request({ kind: context.session?.pausedat ? \"resumesession\" : \"pausesession\" }); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\nstopbutton?.addEventListener(\"click\", async () => { try { await request({ kind: \"stop\" }); status(\"Session stopped. No action can continue.\"); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\nopenbutton?.addEventListener(\"click\", () => chrome.sidePanel.open({ windowId: chrome.windows.WINDOW_ID_CURRENT }));\nrestore().catch(error => status(error instanceof Error ? error.message : String(error), true));\n"],
-  "mappings": ";AAEA,IAAM,mBAAmB,oBAAI,IAAgB,CAAC,SAAS,QAAQ,YAAY,UAAU,YAAY,QAAQ,QAAQ,UAAU,SAAS,SAAS,WAAW,UAAU,UAAU,UAAU,QAAQ,WAAW,gBAAgB,gBAAgB,mBAAmB,YAAY,aAAa,eAAe,YAAY,aAAa,gBAAgB,eAAe,gBAAgB,gBAAgB,cAAc,cAAc,iBAAiB,cAAc,YAAY,cAAc,YAAY,YAAY,WAAW,cAAc,gBAAgB,eAAe,eAAe,aAAa,WAAW,UAAU,CAAC;AACnlB,IAAM,qBAAqB,oBAAI,IAAgB,CAAC,SAAS,UAAU,SAAS,aAAa,cAAc,eAAe,cAAc,YAAY,aAAa,aAAa,cAAc,WAAW,eAAe,aAAa,aAAa,aAAa,iBAAiB,gBAAgB,aAAa,CAAC;AACxS,IAAM,cAAc,oBAAI,IAAgB,CAAC,WAAW,WAAW,WAAW,QAAQ,WAAW,YAAY,iBAAiB,aAAa,gBAAgB,aAAa,YAAY,YAAY,iBAAiB,aAAa,aAAa,cAAc,YAAY,aAAa,eAAe,aAAa,WAAW,cAAc,eAAe,aAAa,iBAAiB,iBAAiB,gBAAgB,YAAY,eAAe,cAAc,eAAe,gBAAgB,YAAY,eAAe,aAAa,eAAe,wBAAwB,iBAAiB,cAAc,iBAAiB,YAAY,eAAe,cAAc,cAAc,cAAc,gBAAgB,sBAAsB,iBAAiB,iBAAiB,cAAc,gBAAgB,oBAAoB,iBAAiB,kBAAkB,gBAAgB,CAAC;AAC30B,IAAM,iBAAiB,oBAAI,IAAgB,CAAC,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,WAAW,CAAC;AAMhG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAW,IAAI,IAAI,MAAM,KAAK,CAAC;AACrC,MAAI,SAAS,aAAa,SAAU,OAAM,IAAI,MAAM,wCAAwC;AAC5F,MAAI,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,MAAM,kDAAkD;AAC9G,SAAO,EAAE,UAAU,SAAS,SAAS,GAAG,QAAQ,SAAS,QAAQ,cAAc,KAAK,IAAI,EAAE;AAC5F;AAGO,SAAS,YAAY,QAAwB;AAClD,QAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,MAAI,OAAO,aAAa,SAAU,OAAM,IAAI,MAAM,oCAAoC;AACtF,SAAO,GAAG,OAAO,MAAM;AACzB;;;AClBA,IAAM,gBAAgB,SAAS,cAAgC,WAAW;AAC1E,IAAM,aAAa,SAAS,cAA2B,SAAS;AAChE,IAAM,mBAAmB,SAAS,cAA2B,eAAe;AAC5E,IAAM,WAAW,SAAS,cAA2B,YAAY;AACjE,IAAM,gBAAgB,SAAS,cAAiC,UAAU;AAC1E,IAAM,gBAAgB,SAAS,cAAiC,UAAU;AAC1E,IAAM,cAAc,SAAS,cAAiC,QAAQ;AACtE,IAAM,aAAa,SAAS,cAAiC,OAAO;AACpE,IAAM,aAAa,SAAS,cAAiC,YAAY;AAEzE,SAAS,OAAO,SAAiB,QAAQ,OAAa;AAAE,MAAI,YAAY;AAAE,eAAW,cAAc;AAAS,eAAW,QAAQ,QAAQ,QAAQ,UAAU;AAAA,EAAS;AAAE;AACpK,eAAe,QAAQ,SAAoC;AAAE,QAAM,WAAW,MAAM,OAAO,QAAQ,YAAY,OAAO;AAAuD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,SAAS,KAAK;AAAG,SAAO,SAAS;AAAO;AAEvP,SAAS,WAAW,QAAyB;AAAE,SAAO,SAAS,mBAAmB;AAAiB;AAGnG,SAAS,mBAAmB,QAAiC;AAC3D,MAAI,CAAC,iBAAkB;AACvB,MAAI,CAAC,QAAQ;AAAE,qBAAiB,cAAc;AAAyB;AAAA,EAAQ;AAC/E,QAAM,UAAU,CAAC,QAAQ,OAAO,OAAO,YAAY,QAAQ,IAAI,aAAa,OAAO,YAAY,YAAY,QAAQ,IAAI,kBAAkB,OAAO,gBAAgB,YAAY,QAAQ,IAAI,mBAAmB,OAAO,iBAAiB,YAAY,QAAQ,EAAE;AACzP,mBAAiB,cAAc,0BAA0B,QAAQ,KAAK,QAAK,CAAC;AAC9E;AAGA,SAAS,gBAAgB,OAAwB,SAA4B,SAAgC;AAC3G,MAAI,CAAC,SAAU;AACf,QAAM,QAAQ,SAAS,CAAC,GAAG,OAAO,UAAQ,KAAK,eAAe,MAAS;AACvE,QAAM,cAAc,KAAK,SAAS,IAAI,KAAK,IAAI,UAAQ,GAAG,KAAK,GAAG,GAAG,KAAK,SAAS,KAAK,KAAK,MAAM,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI,IAAI;AAC5H,QAAM,iBAAiB,WAAW,CAAC,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,cAAc;AACnF,QAAM,QAAQ,YAAY,QAAQ,aAAa,UAAa,QAAQ,aAAa,UAAa,QAAQ,iBAAiB,UACnH,CAAC,QAAQ,aAAa,SAAY,YAAY,QAAQ,YAAY,SAAS,KAAK,IAAI,QAAQ,aAAa,SAAY,YAAY,QAAQ,QAAQ,KAAK,IAAI,QAAQ,iBAAiB,SAAY,eAAe,QAAQ,eAAe,OAAO,KAAK,KAAK,EAAE,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK,IACpR;AACJ,WAAS,cAAc,cAAc,WAAW,gCAA6B,aAAa,uBAAoB,KAAK;AACrH;AAEA,eAAe,UAAyB;AACtC,QAAM,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,CAAC;AACjD,MAAI,iBAAiB,QAAQ,OAAQ,eAAc,QAAQ,QAAQ,OAAO;AAC1E,qBAAmB,QAAQ,YAAY;AACvC,kBAAgB,QAAQ,OAAO,UAAU,QAAQ,SAAS,QAAQ,OAAO;AACzE,QAAM,SAAS,QAAQ,WAAW,CAAC,QAAQ,QAAQ,aAAa,QAAQ,QAAQ,YAAY,KAAK,IAAI;AACrG,MAAI,aAAa;AAAE,gBAAY,WAAW,CAAC;AAAQ,gBAAY,cAAc,WAAW,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,EAAG;AAC7H,MAAI,UAAU,QAAQ,SAAS,SAAU,QAAO,4DAA4D;AAAA,MACvG,QAAO,SAAS,uDAAuD,4BAA4B;AAC1G;AAEA,eAAe,iBAAiB,SAAS,YAAY;AACnD,MAAI;AACF,UAAM,SAAS,kBAAkB,eAAe,SAAS,EAAE;AAC3D,UAAM,UAAU,MAAM,OAAO,YAAY,QAAQ,EAAE,SAAS,CAAC,YAAY,OAAO,MAAM,CAAC,EAAE,CAAC;AAC1F,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAClE,UAAM,QAAQ,EAAE,MAAM,aAAa,UAAU,OAAO,SAAS,CAAC;AAC9D,WAAO,yBAAyB,OAAO,MAAM,GAAG;AAAA,EAClD,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAC1F,CAAC;AACD,eAAe,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,QAAQ,EAAE,MAAM,eAAe,CAAC;AAAG,WAAO,2CAA2C;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AACvQ,aAAa,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,CAAC;AAA0C,UAAM,QAAQ,EAAE,MAAM,QAAQ,SAAS,WAAW,kBAAkB,eAAe,CAAC;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AACzV,YAAY,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAG,WAAO,0CAA0C;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AAC3P,YAAY,iBAAiB,SAAS,MAAM,OAAO,UAAU,KAAK,EAAE,UAAU,OAAO,QAAQ,kBAAkB,CAAC,CAAC;AACjH,QAAQ,EAAE,MAAM,WAAS,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI,CAAC;",
+  "sourcesContent": ["import type { actionkind, agentplan, agentsession, endpointconfig, observationmode, policyevaluation, safetyverdict, toolstep } from \"./types.js\";\n\nconst sensitiveactions = new Set<actionkind>([\"click\", \"type\", \"navigate\", \"select\", \"presskey\", \"drag\", \"drop\", \"upload\", \"clear\", \"check\", \"uncheck\", \"toggle\", \"submit\", \"reload\", \"back\", \"forward\", \"writestorage\", \"setattribute\", \"removeattribute\", \"evaluate\", \"tabcreate\", \"tabactivate\", \"tabclose\", \"tabreload\", \"windowcreate\", \"windowclose\", \"windowresize\", \"downloadfile\", \"clickpoint\", \"shiftclick\", \"dismissdialog\", \"enterframe\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"keyhold\", \"keyrelease\", \"submitsearch\", \"selectmulti\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\", \"openlink\", \"openprivate\", \"reloadcache\", \"stopnav\", \"followlink\", \"spanav\", \"rewritequery\", \"setfragment\", \"navlist\", \"navprofile\", \"handleauth\", \"printpdf\", \"prefetch\", \"preconnect\", \"deeplink\", \"reopentab\", \"pausenav\", \"navrate\", \"openclipboard\", \"batchopen\"]);\nconst interactionactions = new Set<actionkind>([\"focus\", \"scroll\", \"hover\", \"clickdeep\", \"rightclick\", \"doubleclick\", \"scrollpage\", \"scrollby\", \"scrollend\", \"scrolltop\", \"fullscreen\", \"zoomset\", \"movepointer\", \"clicktext\", \"clickaria\", \"clickname\", \"expanddetails\", \"pierceshadow\", \"retryaction\"]);\nconst readactions = new Set<actionkind>([\"observe\", \"inspect\", \"extract\", \"wait\", \"waitfor\", \"waittext\", \"readattribute\", \"readstyle\", \"readgeometry\", \"readvalue\", \"readtext\", \"readhtml\", \"countelements\", \"readtable\", \"readlinks\", \"readimages\", \"readmeta\", \"readforms\", \"readstorage\", \"highlight\", \"tablist\", \"windowlist\", \"tabsnapshot\", \"mapclicks\", \"verifyvisible\", \"verifyenabled\", \"resolvexpath\", \"a11ytree\", \"readvisible\", \"readertree\", \"detectlists\", \"detecttables\", \"readjson\", \"watchmutate\", \"waitquiet\", \"watchbanner\", \"detectinfinitescroll\", \"detectvirtual\", \"detectlazy\", \"readscrollpos\", \"readlang\", \"readoutline\", \"countpages\", \"listshadow\", \"listframes\", \"classifypage\", \"fingerprintsection\", \"diffsnapshots\", \"readselection\", \"watchfocus\", \"detectsticky\", \"detectscrolllock\", \"readopengraph\", \"detectlanguage\", \"deriveselector\", \"waitload\", \"waiturl\", \"spawait\", \"detecthttp\", \"readredirects\", \"readfinalurl\", \"trailaudit\", \"navintent\", \"checksafe\"]);\nconst allowedactions = new Set<actionkind>([...sensitiveactions, ...interactionactions, ...readactions]);\nconst watchactions = new Set<actionkind>([\"watchmutate\", \"watchbanner\", \"watchfocus\"]);\nconst targetactions = new Set<actionkind>([\"inspect\", \"focus\", \"click\", \"type\", \"scroll\", \"select\", \"hover\", \"clickdeep\", \"rightclick\", \"doubleclick\", \"drag\", \"drop\", \"upload\", \"clear\", \"check\", \"uncheck\", \"toggle\", \"submit\", \"readattribute\", \"readstyle\", \"readgeometry\", \"readvalue\", \"readtext\", \"readhtml\", \"countelements\", \"readtable\", \"highlight\", \"setattribute\", \"removeattribute\", \"waitfor\", \"shiftclick\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"submitsearch\", \"selectmulti\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\", \"expanddetails\", \"verifyvisible\", \"verifyenabled\", \"pierceshadow\", \"deriveselector\", \"fingerprintsection\"]);\nconst valueactions = new Set<actionkind>([\"presskey\", \"drag\", \"drop\", \"upload\", \"readattribute\", \"removeattribute\", \"waittext\", \"evaluate\", \"zoomset\", \"tabactivate\", \"tabclose\", \"tabreload\", \"windowclose\", \"windowresize\", \"tabcreate\", \"windowcreate\", \"downloadfile\", \"typetime\", \"appendtext\", \"setvalue\", \"typeedit\", \"keyhold\", \"keyrelease\", \"chooseradio\", \"setslider\", \"setdate\", \"setcolor\", \"followlink\", \"setfragment\", \"handleauth\", \"navintent\", \"openclipboard\", \"checksafe\", \"reopentab\", \"spanav\"]);\n\n/** Normalizes a user supplied HTTPS endpoint without preserving a provider lock-in. */\nexport function normalizeendpoint(value: string): endpointconfig {\n  const endpoint = new URL(value.trim());\n  if (endpoint.protocol !== \"https:\") throw new Error(\"Devthink accepts HTTPS endpoints only.\");\n  if (endpoint.username || endpoint.password) throw new Error(\"Endpoint credentials are not allowed in the URL.\");\n  return { endpoint: endpoint.toString(), origin: endpoint.origin, configuredat: Date.now() };\n}\n\n/** Creates the exact optional host pattern requested from Chromium. */\nexport function hostpattern(origin: string): string {\n  const parsed = new URL(origin);\n  if (parsed.protocol !== \"https:\") throw new Error(\"Only HTTPS origins can be granted.\");\n  return `${parsed.origin}/*`;\n}\n\n/** True when the action kind observes the page over a reviewed lifetime window. */\nexport function iswatchkind(kind: actionkind): boolean {\n  return watchactions.has(kind);\n}\n\n/** Grades the observation mode of a kind: passive capture, watched lifetimes or diffing passes. */\nexport function observationmodeof(kind: actionkind): observationmode {\n  if (watchactions.has(kind) || kind === \"waitquiet\") return \"watching\";\n  if (kind === \"diffsnapshots\") return \"diffing\";\n  return \"passive\";\n}\n\n/** Defines action risk from the fixed local allowlist. */\nexport function actionrisk(kind: actionkind): \"read\" | \"interaction\" | \"sensitive\" {\n  if (!allowedactions.has(kind)) throw new Error(\"Unsupported browser action.\");\n  if (sensitiveactions.has(kind)) return \"sensitive\";\n  return interactionactions.has(kind) ? \"interaction\" : \"read\";\n}\n\n/** True when the action kind accepts a css selector target or a reviewed targetref. */\nexport function needstarget(kind: actionkind): boolean {\n  return targetactions.has(kind);\n}\n\n/** Parses the reviewed JSON options of a step; malformed payloads are rejected early. */\nexport function parseoptions(step: toolstep): Record<string, unknown> {\n  if (step.options === undefined) return {};\n  let parsed: unknown;\n  try { parsed = JSON.parse(step.options); } catch { throw new Error(\"Step options must be a JSON object.\"); }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new Error(\"Step options must be a JSON object.\");\n  return parsed as Record<string, unknown>;\n}\n\n/** Maps an action kind to the optional browser permission it requires, if any. */\nexport function requiredcapability(kind: actionkind): string | undefined {\n  if (kind === \"tablist\") return \"tabs\";\n  if (kind === \"downloadfile\") return \"downloads\";\n  if (kind === \"openclipboard\") return \"clipboardRead\";\n  if (kind === \"openlink\" || kind === \"openprivate\" || kind === \"navlist\" || kind === \"batchopen\" || kind === \"reopentab\" || kind === \"deeplink\") return \"tabs\";\n  return undefined;\n}\n\n/** Parses the reviewed wait duration of a wait step with no upper bound. */\nexport function waitduration(step: toolstep): number {\n  const requested = step.value ? Number.parseInt(step.value, 10) : 250;\n  if (!Number.isFinite(requested) || requested < 0) throw new Error(\"Wait duration must be zero or a positive number of milliseconds.\");\n  return requested;\n}\n\nfunction isnumericid(value: unknown): value is string {\n  return typeof value === \"string\" && /^\\d+$/.test(value);\n}\n\nfunction numericoption(options: Record<string, unknown>, key: string): boolean {\n  return options[key] === undefined || (typeof options[key] === \"number\" && Number.isFinite(options[key] as number));\n}\n\n/** True when an optional numeric option is absent or a finite number of zero or more. */\nfunction nonnegativeoption(options: Record<string, unknown>, key: string): boolean {\n  return numericoption(options, key) && !(typeof options[key] === \"number\" && (options[key] as number) < 0);\n}\n\nfunction isnonempty(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction ispoint(value: unknown): boolean {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const point = value as Record<string, unknown>;\n  return typeof point.x === \"number\" && Number.isFinite(point.x) && typeof point.y === \"number\" && Number.isFinite(point.y);\n}\n\n/** Grades a resolution match count: zero is absent, one is resolved and more than one is refused as ambiguous. */\nexport function resolutionverdict(count: number): \"absent\" | \"resolved\" | \"ambiguous\" {\n  if (!Number.isFinite(count) || count <= 0) return \"absent\";\n  return count === 1 ? \"resolved\" : \"ambiguous\";\n}\n\n/** Validates the reviewed targetref grammar of every resolution mode and rejects empty references. */\nexport function validatetargetref(reference: unknown): policyevaluation {\n  if (!reference || typeof reference !== \"object\" || Array.isArray(reference)) return { allowed: false, reason: \"The reviewed target reference must be an object.\" };\n  const ref = reference as Record<string, unknown>;\n  if (ref.mode === \"selector\") return isnonempty(ref.selector) ? { allowed: true } : { allowed: false, reason: \"The selector target reference needs a non-empty selector.\" };\n  if (ref.mode === \"text\") return isnonempty(ref.text) ? { allowed: true } : { allowed: false, reason: \"The text target reference needs non-empty text.\" };\n  if (ref.mode === \"aria\") {\n    if (!isnonempty(ref.role)) return { allowed: false, reason: \"The aria target reference needs a non-empty role.\" };\n    return isnonempty(ref.name) ? { allowed: true } : { allowed: false, reason: \"The aria target reference needs a non-empty name.\" };\n  }\n  if (ref.mode === \"name\") return isnonempty(ref.name) ? { allowed: true } : { allowed: false, reason: \"The name target reference needs a non-empty name.\" };\n  if (ref.mode === \"xpath\") return isnonempty(ref.xpath) ? { allowed: true } : { allowed: false, reason: \"The xpath target reference needs a non-empty expression.\" };\n  if (ref.mode === \"index\") {\n    const index = ref.index;\n    return typeof index === \"number\" && Number.isInteger(index) && index >= 1 ? { allowed: true } : { allowed: false, reason: \"The index target reference needs a positive integer map number.\" };\n  }\n  if (ref.mode === \"point\") {\n    const pointok = typeof ref.x === \"number\" && Number.isFinite(ref.x) && typeof ref.y === \"number\" && Number.isFinite(ref.y);\n    return pointok ? { allowed: true } : { allowed: false, reason: \"The point target reference needs numeric x and y coordinates.\" };\n  }\n  return { allowed: false, reason: \"The target reference mode must be selector, text, aria, name, xpath, index or point.\" };\n}\n\n/** True when the session origin grants cover the given origin; a session without grants only allows its own origin. */\nexport function origingranted(session: agentsession | undefined, origin: string): boolean {\n  if (!session) return false;\n  const grants = session.grants ?? [session.origin];\n  return grants.includes(origin);\n}\n\n/** Decides whether an unreviewed origin may open: the session grants cover it or a safe checksafe verdict vouches for it. */\nexport function originverified(url: string, grants: string[], verdicts: safetyverdict[]): policyevaluation {\n  let origin = \"\";\n  try { origin = new URL(url).origin; } catch { return { allowed: false, reason: \"The reviewed navigation URL is invalid.\" }; }\n  if (grants.includes(origin)) return { allowed: true };\n  const covered = verdicts.find(verdict => verdict.safe && (verdict.url === url || (safeorigin(verdict.url) === origin)));\n  if (covered) return { allowed: true };\n  return { allowed: false, reason: `The origin ${origin} is outside the session grants and has no safe checksafe verdict; run checksafe and review it first.` };\n}\n\nfunction safeorigin(url: string): string {\n  try { return new URL(url).origin; } catch { return \"\"; }\n}\n\n/** Refuses navigation that would move a granted task tab outside the session origin grants until the user consents. */\nexport function navigationgranted(session: agentsession | undefined, url: string): policyevaluation {\n  let origin = \"\";\n  try { origin = new URL(url).origin; } catch { return { allowed: false, reason: \"The reviewed navigation URL is invalid.\" }; }\n  if (origingranted(session, origin)) return { allowed: true };\n  return { allowed: false, reason: `Navigation to ${origin} leaves the task tab origins and needs the user consent of a session grant first.` };\n}\n\n/** Validates the reviewed inner step of a retry or frame wrapper against the same rules as a top-level step. */\nfunction validateinnerstep(options: Record<string, unknown>, origin: string): policyevaluation {\n  const stepid = options.stepid;\n  const kind = options.kind;\n  if (isnonempty(stepid)) {\n    if (kind !== undefined) return { allowed: false, reason: \"The reviewed wrapper must reference a step id or an inline step, not both.\" };\n    return { allowed: true };\n  }\n  if (typeof kind !== \"string\" || !kind.trim()) return { allowed: false, reason: \"A reviewed step id or inline step kind is required in options.\" };\n  if (kind === \"retryaction\" || kind === \"enterframe\") return { allowed: false, reason: \"The reviewed inner step cannot be another wrapper kind.\" };\n  if (!allowedactions.has(kind as actionkind)) return { allowed: false, reason: \"The reviewed inner step kind is unsupported.\" };\n  const inneroptions = options.options;\n  if (inneroptions !== undefined && (!inneroptions || typeof inneroptions !== \"object\" || Array.isArray(inneroptions))) return { allowed: false, reason: \"The reviewed inner step options must be an object.\" };\n  const inner: toolstep = {\n    id: \"inner\",\n    kind: kind as actionkind,\n    summary: \"Reviewed inner step.\",\n    risk: actionrisk(kind as actionkind),\n    ...(isnonempty(options.target) ? { target: options.target } : {}),\n    ...(isnonempty(options.value) ? { value: options.value } : {}),\n    ...(inneroptions !== undefined ? { options: JSON.stringify(inneroptions) } : {}),\n  };\n  return validatestep(inner, origin);\n}\n\n/** True when a reviewed https url parses. */\nfunction ishttpsurl(value: unknown): value is string {\n  if (typeof value !== \"string\" || !value.trim()) return false;\n  try { return new URL(value).protocol === \"https:\"; } catch { return false; }\n}\n\n/** Validates the reviewed navtarget grammar of a navigation step. */\nfunction validatenavtarget(value: unknown, kind: string): policyevaluation {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return { allowed: false, reason: \"A reviewed navtarget with a url is required in options.\" };\n  const target = value as Record<string, unknown>;\n  if (!ishttpsurl(target.url)) return { allowed: false, reason: \"The reviewed navtarget url must use HTTPS.\" };\n  const container = target.container ?? \"tab\";\n  if (container !== \"current\" && container !== \"tab\" && container !== \"window\" && container !== \"private\") return { allowed: false, reason: \"The reviewed navtarget container must be current, tab, window or private.\" };\n  if (target.position !== undefined && target.position !== \"adjacent\" && target.position !== \"end\") return { allowed: false, reason: \"The reviewed navtarget position must be adjacent or end.\" };\n  if (kind === \"openprivate\" && container !== \"private\") return { allowed: false, reason: \"The openprivate step requires the private container.\" };\n  if (kind === \"openlink\" && container === \"private\") return { allowed: false, reason: \"The openlink step cannot open the private container; use openprivate.\" };\n  return { allowed: true };\n}\n\n/** Validates the reviewed waitprofile grammar with its load signals, thresholds and per origin overrides. */\nfunction validatewaitprofile(value: unknown): policyevaluation {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return { allowed: false, reason: \"A reviewed waitprofile with load signals is required in options.\" };\n  const profile = value as Record<string, unknown>;\n  if (!Array.isArray(profile.signals) || profile.signals.length === 0 || !profile.signals.every(signal => isnonempty(signal))) return { allowed: false, reason: \"The reviewed waitprofile needs a non-empty list of load signals.\" };\n  if (!nonnegativeoption(profile, \"idle\")) return { allowed: false, reason: \"The reviewed waitprofile idle threshold must be zero or a positive number of milliseconds.\" };\n  if (!nonnegativeoption(profile, \"timeout\")) return { allowed: false, reason: \"The reviewed waitprofile timeout must be zero or a positive number of milliseconds.\" };\n  if (profile.overrides !== undefined) {\n    if (!Array.isArray(profile.overrides) || profile.overrides.length === 0) return { allowed: false, reason: \"The reviewed waitprofile overrides must be a non-empty list when present.\" };\n    for (const entry of profile.overrides) {\n      if (!entry || typeof entry !== \"object\" || Array.isArray(entry)) return { allowed: false, reason: \"Every reviewed waitprofile override must be an object with an origin.\" };\n      const override = entry as Record<string, unknown>;\n      if (!ishttpsurl(override.origin)) return { allowed: false, reason: \"Every reviewed waitprofile override origin must use HTTPS.\" };\n      if (override.signals !== undefined && (!Array.isArray(override.signals) || !override.signals.every(signal => isnonempty(signal)))) return { allowed: false, reason: \"The reviewed waitprofile override signals must be a list of non-empty strings.\" };\n      if (!nonnegativeoption(override, \"idle\") || !nonnegativeoption(override, \"timeout\")) return { allowed: false, reason: \"The reviewed waitprofile override thresholds must be zero or positive numbers.\" };\n    }\n  }\n  return { allowed: true };\n}\n\n/** Validates the reviewed urlpattern grammar with its match mode plus query and fragment parts. */\nexport function validateurlpattern(value: unknown): policyevaluation {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return { allowed: false, reason: \"A reviewed urlpattern is required in options.\" };\n  const pattern = value as Record<string, unknown>;\n  if (pattern.mode !== \"exact\" && pattern.mode !== \"prefix\" && pattern.mode !== \"host\" && pattern.mode !== \"pattern\") return { allowed: false, reason: \"The reviewed urlpattern mode must be exact, prefix, host or pattern.\" };\n  if (!ishttpsurl(pattern.url)) return { allowed: false, reason: \"The reviewed urlpattern url must use HTTPS.\" };\n  if (pattern.query !== undefined) {\n    if (!pattern.query || typeof pattern.query !== \"object\" || Array.isArray(pattern.query)) return { allowed: false, reason: \"The reviewed urlpattern query part must be an object of parameter names and values.\" };\n    for (const item of Object.values(pattern.query)) if (typeof item !== \"string\") return { allowed: false, reason: \"The reviewed urlpattern query values must be strings.\" };\n  }\n  if (pattern.fragment !== undefined && !isnonempty(pattern.fragment)) return { allowed: false, reason: \"The reviewed urlpattern fragment must be a non-empty string.\" };\n  return { allowed: true };\n}\n\n/** Validates a reviewed non-empty list of HTTPS urls in options. */\nfunction validateurllist(options: Record<string, unknown>, key: string): policyevaluation {\n  const urls = options[key];\n  if (!Array.isArray(urls) || urls.length === 0 || !urls.every(url => ishttpsurl(url))) return { allowed: false, reason: `A reviewed non-empty list of HTTPS urls is required in options as ${key}.` };\n  return { allowed: true };\n}\n\n/** Validates the reviewed ratelimit grammar of a navrate step; the window and ceiling stay user configured with no hardcoded cap. */\nfunction validateratelimit(value: unknown): policyevaluation {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return { allowed: false, reason: \"A reviewed ratelimit with a window and a ceiling is required in options.\" };\n  const limit = value as Record<string, unknown>;\n  if (limit.domain !== undefined && !isnonempty(limit.domain)) return { allowed: false, reason: \"The reviewed ratelimit domain must be a non-empty string.\" };\n  if (typeof limit.window !== \"number\" || !Number.isFinite(limit.window) || limit.window <= 0) return { allowed: false, reason: \"The reviewed ratelimit window must be a positive number of milliseconds with no code ceiling.\" };\n  if (typeof limit.ceiling !== \"number\" || !Number.isInteger(limit.ceiling) || limit.ceiling < 1) return { allowed: false, reason: \"The reviewed ratelimit ceiling must be a positive integer with no code ceiling.\" };\n  return { allowed: true };\n}\n\n/** Validates a single proposal against the active tab origin and local policy. */\nexport function validatestep(step: toolstep, origin: string): policyevaluation {\n  if (!allowedactions.has(step.kind)) return { allowed: false, reason: \"Unsupported action kind.\" };\n  if (!step.summary.trim()) return { allowed: false, reason: \"A human-readable action summary is required.\" };\n  let options: Record<string, unknown>;\n  try { options = parseoptions(step); } catch { return { allowed: false, reason: \"Step options must be a JSON object.\" }; }\n  const hastargetref = options.targetref !== undefined;\n  if (targetactions.has(step.kind) && !step.target?.trim() && !hastargetref) return { allowed: false, reason: \"A page target is required.\" };\n  if (valueactions.has(step.kind) && !step.value?.trim()) return { allowed: false, reason: \"A reviewed value is required.\" };\n  if (step.kind === \"select\" && !step.value?.trim()) return { allowed: false, reason: \"A reviewed option value is required.\" };\n  if (step.kind === \"navigate\" && !step.value) return { allowed: false, reason: \"A navigation URL is required.\" };\n  if (hastargetref) {\n    const reference = validatetargetref(options.targetref);\n    if (!reference.allowed) return reference;\n  }\n  if (step.kind === \"wait\") {\n    try { waitduration(step); } catch { return { allowed: false, reason: \"Wait duration must be zero or a positive number of milliseconds.\" }; }\n  }\n  if (step.kind === \"navigate\") {\n    try {\n      if (new URL(step.value ?? \"\").origin !== origin) return { allowed: false, reason: \"Navigation must remain within the approved origin.\" };\n    } catch {\n      return { allowed: false, reason: \"Navigation URL is invalid.\" };\n    }\n  }\n  if (step.kind === \"tabcreate\" || step.kind === \"windowcreate\" || step.kind === \"downloadfile\") {\n    try {\n      const url = new URL(step.value ?? \"\");\n      if (url.protocol !== \"https:\") return { allowed: false, reason: \"The reviewed URL must use HTTPS.\" };\n    } catch {\n      return { allowed: false, reason: \"The reviewed URL is invalid.\" };\n    }\n  }\n  if (step.kind === \"tabactivate\" || step.kind === \"tabclose\" || step.kind === \"tabreload\" || step.kind === \"windowclose\" || step.kind === \"windowresize\") {\n    if (!isnumericid(step.value)) return { allowed: false, reason: \"A numeric browser id is required.\" };\n  }\n  if (step.kind === \"zoomset\") {\n    const zoom = Number(step.value);\n    if (!Number.isFinite(zoom) || zoom <= 0) return { allowed: false, reason: \"The reviewed zoom must be a positive number.\" };\n  }\n  if (step.kind === \"setattribute\" || step.kind === \"writestorage\") {\n    const keyname = step.kind === \"setattribute\" ? \"name\" : \"key\";\n    if (typeof options[keyname] !== \"string\" || !(options[keyname] as string).trim()) return { allowed: false, reason: `A reviewed ${keyname} is required in options.` };\n    if (typeof options.value !== \"string\") return { allowed: false, reason: \"A reviewed value is required in options.\" };\n  }\n  if (step.kind === \"windowresize\") {\n    if (typeof options.width !== \"number\" || typeof options.height !== \"number\" || !Number.isFinite(options.width) || !Number.isFinite(options.height)) return { allowed: false, reason: \"Reviewed width and height numbers are required in options.\" };\n  }\n  if ((step.kind === \"scrollpage\" || step.kind === \"scrollby\") && (!numericoption(options, \"x\") || !numericoption(options, \"y\"))) return { allowed: false, reason: \"Scroll amounts must be numbers in options.\" };\n  if (step.kind === \"waitfor\" && options.timeout !== undefined && (typeof options.timeout !== \"number\" || options.timeout < 0)) return { allowed: false, reason: \"The waitfor timeout must be zero or a positive number of milliseconds.\" };\n  if (step.kind === \"movepointer\") {\n    const path = options.pointpath;\n    if (!path || typeof path !== \"object\" || Array.isArray(path)) return { allowed: false, reason: \"A reviewed pointpath with start and end points is required in options.\" };\n    const points = path as Record<string, unknown>;\n    if (!ispoint(points.start) || !ispoint(points.end)) return { allowed: false, reason: \"The reviewed pointpath needs numeric start and end points.\" };\n    if (points.waypoints !== undefined && (!Array.isArray(points.waypoints) || !points.waypoints.every(waypoint => ispoint(waypoint)))) return { allowed: false, reason: \"The reviewed pointpath waypoints must be numeric points.\" };\n    if (!nonnegativeoption(points, \"duration\")) return { allowed: false, reason: \"The reviewed pointpath duration must be zero or a positive number of milliseconds.\" };\n    const speed = options.speedprofile;\n    if (speed !== undefined) {\n      if (!speed || typeof speed !== \"object\" || Array.isArray(speed)) return { allowed: false, reason: \"The reviewed speed profile must be an object.\" };\n      const profile = speed as Record<string, unknown>;\n      if (profile.easing !== undefined && profile.easing !== \"linear\" && profile.easing !== \"easeinout\") return { allowed: false, reason: \"The reviewed easing must be linear or easeinout.\" };\n      if (!nonnegativeoption(profile, \"peak\")) return { allowed: false, reason: \"The reviewed peak velocity must be zero or a positive number.\" };\n      if (!nonnegativeoption(profile, \"jitter\")) return { allowed: false, reason: \"The reviewed jitter window must be zero or a positive number of milliseconds.\" };\n    }\n  }\n  if (step.kind === \"clickpoint\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"point\")) return { allowed: false, reason: \"A reviewed point target reference is required in options.\" };\n  if (step.kind === \"clicktext\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"text\")) return { allowed: false, reason: \"A reviewed text target reference is required in options.\" };\n  if (step.kind === \"clickaria\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"aria\")) return { allowed: false, reason: \"A reviewed aria target reference is required in options.\" };\n  if (step.kind === \"clickname\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"name\")) return { allowed: false, reason: \"A reviewed name target reference is required in options.\" };\n  if (step.kind === \"resolvexpath\" && (!hastargetref || (options.targetref as Record<string, unknown>).mode !== \"xpath\")) return { allowed: false, reason: \"A reviewed xpath target reference is required in options.\" };\n  if (step.kind === \"typetime\" && options.delay !== undefined && (typeof options.delay !== \"number\" || !Number.isFinite(options.delay) || options.delay < 0)) return { allowed: false, reason: \"The reviewed per keystroke delay must be zero or a positive number of milliseconds.\" };\n  if (step.kind === \"submitsearch\") {\n    if (!isnonempty(options.results)) return { allowed: false, reason: \"A reviewed results region selector is required in options.\" };\n    if (options.timeout !== undefined && (typeof options.timeout !== \"number\" || !Number.isFinite(options.timeout) || options.timeout < 0)) return { allowed: false, reason: \"The submitsearch timeout must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"selectmulti\") {\n    const values = options.values;\n    if (!Array.isArray(values) || values.length === 0 || !values.every(value => isnonempty(value))) return { allowed: false, reason: \"A reviewed list of option values is required in options.\" };\n  }\n  if (step.kind === \"setslider\") {\n    const slider = Number(step.value);\n    if (!Number.isFinite(slider)) return { allowed: false, reason: \"The reviewed slider value must be a number.\" };\n  }\n  if (step.kind === \"setdate\" && !/^\\d{4}-\\d{2}-\\d{2}$/.test(step.value ?? \"\")) return { allowed: false, reason: \"The reviewed date must use the yyyy-mm-dd form.\" };\n  if (step.kind === \"setcolor\" && !/^#[0-9a-fA-F]{6}$/.test(step.value ?? \"\")) return { allowed: false, reason: \"The reviewed color must use the #rrggbb form.\" };\n  if (step.kind === \"keyhold\" && options.holdid !== undefined && !isnonempty(options.holdid)) return { allowed: false, reason: \"The reviewed hold id must be a non-empty string.\" };\n  if (step.kind === \"dismissdialog\") {\n    const accept = options.accept;\n    const answer = options.answer;\n    if (accept === undefined && !isnonempty(answer)) return { allowed: false, reason: \"A reviewed accept flag or prompt answer is required in options.\" };\n    if (accept !== undefined && typeof accept !== \"boolean\") return { allowed: false, reason: \"The reviewed dialog accept flag must be a boolean.\" };\n    if (answer !== undefined && !isnonempty(answer)) return { allowed: false, reason: \"The reviewed prompt answer must be a non-empty string.\" };\n  }\n  if (step.kind === \"pierceshadow\" && options.shadow !== undefined) {\n    if (!Array.isArray(options.shadow) || !options.shadow.every(item => isnonempty(item))) return { allowed: false, reason: \"The reviewed shadow path must be a list of non-empty selectors.\" };\n  }\n  if (step.kind === \"enterframe\") {\n    const path = options.framepath;\n    if (!Array.isArray(path) || path.length === 0 || !path.every(item => typeof item === \"number\" && Number.isInteger(item) && item >= 0)) return { allowed: false, reason: \"A reviewed frame path of frame indexes is required in options.\" };\n    return validateinnerstep(options, origin);\n  }\n  if (step.kind === \"retryaction\") {\n    const inner = validateinnerstep(options, origin);\n    if (!inner.allowed) return inner;\n    const rule = options.retryrule;\n    if (!rule || typeof rule !== \"object\" || Array.isArray(rule)) return { allowed: false, reason: \"A reviewed retry rule with attempts is required in options.\" };\n    const retry = rule as Record<string, unknown>;\n    if (typeof retry.attempts !== \"number\" || !Number.isInteger(retry.attempts) || retry.attempts < 1) return { allowed: false, reason: \"The reviewed retry attempts must be a positive integer with no code ceiling.\" };\n    if (!nonnegativeoption(retry, \"settle\")) return { allowed: false, reason: \"The reviewed retry settle window must be zero or a positive number of milliseconds.\" };\n    if (!nonnegativeoption(retry, \"tolerance\")) return { allowed: false, reason: \"The reviewed retry movement tolerance must be zero or a positive number of pixels.\" };\n  }\n  if (watchactions.has(step.kind)) {\n    if (typeof options.lifetime !== \"number\" || !Number.isFinite(options.lifetime) || options.lifetime <= 0) return { allowed: false, reason: \"A reviewed watch lifetime window in milliseconds is required in options.\" };\n    if (options.scopes !== undefined && (!Array.isArray(options.scopes) || !options.scopes.every(scope => isnonempty(scope)))) return { allowed: false, reason: \"The reviewed watch scopes must be a list of non-empty selectors.\" };\n    if (options.events !== undefined && (!Array.isArray(options.events) || !options.events.every(event => isnonempty(event)))) return { allowed: false, reason: \"The reviewed watch event kinds must be a list of non-empty strings.\" };\n    if (!nonnegativeoption(options, \"poll\")) return { allowed: false, reason: \"The reviewed watch poll interval must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"waitquiet\") {\n    const rule = options.quietrule;\n    if (!rule || typeof rule !== \"object\" || Array.isArray(rule)) return { allowed: false, reason: \"A reviewed quietrule with an idle threshold is required in options.\" };\n    const quiet = rule as Record<string, unknown>;\n    if (typeof quiet.idle !== \"number\" || !Number.isFinite(quiet.idle) || quiet.idle <= 0) return { allowed: false, reason: \"The reviewed quiet idle threshold must be a positive number of milliseconds with no code ceiling.\" };\n    if (!nonnegativeoption(quiet, \"poll\")) return { allowed: false, reason: \"The reviewed quiet poll interval must be zero or a positive number of milliseconds.\" };\n    if (!nonnegativeoption(quiet, \"timeout\")) return { allowed: false, reason: \"The reviewed quiet timeout must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"diffsnapshots\") {\n    const versions = options.versions;\n    if (!Array.isArray(versions) || versions.length !== 2 || !versions.every(version => typeof version === \"number\" && Number.isInteger(version) && version >= 1)) return { allowed: false, reason: \"Two reviewed observation version numbers are required in options.\" };\n  }\n  if (step.kind === \"openlink\" || step.kind === \"openprivate\" || step.kind === \"deeplink\") {\n    const targetcheck = validatenavtarget(options.navtarget, step.kind);\n    if (!targetcheck.allowed) return targetcheck;\n    if (step.kind === \"deeplink\") {\n      const app = options.app;\n      if (!isnonempty(app)) return { allowed: false, reason: \"A reviewed deep link app pattern is required in options.\" };\n      const params = options.params;\n      if (params !== undefined && (!params || typeof params !== \"object\" || Array.isArray(params) || !Object.values(params).every(item => typeof item === \"string\"))) return { allowed: false, reason: \"The reviewed deep link params must be an object of string values.\" };\n    }\n  }\n  if (step.kind === \"waitload\" && !nonnegativeoption(options, \"timeout\")) return { allowed: false, reason: \"The waitload timeout must be zero or a positive number of milliseconds.\" };\n  if (step.kind === \"waiturl\" || step.kind === \"spawait\") {\n    if (step.kind === \"waiturl\") {\n      const patterncheck = validateurlpattern(options.urlpattern);\n      if (!patterncheck.allowed) return patterncheck;\n    }\n    if (!nonnegativeoption(options, \"timeout\")) return { allowed: false, reason: \"The wait timeout must be zero or a positive number of milliseconds.\" };\n    if (!nonnegativeoption(options, \"poll\")) return { allowed: false, reason: \"The wait poll interval must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"followlink\") {\n    if (options.fragment !== undefined && typeof options.fragment !== \"boolean\") return { allowed: false, reason: \"The reviewed followlink fragment flag must be a boolean.\" };\n  }\n  if (step.kind === \"spanav\") {\n    if (options.routepattern !== undefined) {\n      const routecheck = validateurlpattern(options.routepattern);\n      if (!routecheck.allowed) return routecheck;\n    }\n    if (!nonnegativeoption(options, \"timeout\")) return { allowed: false, reason: \"The spanav route timeout must be zero or a positive number of milliseconds.\" };\n  }\n  if (step.kind === \"rewritequery\") {\n    const set = options.set;\n    const remove = options.remove;\n    if (set === undefined && remove === undefined) return { allowed: false, reason: \"Reviewed query parameters to set or remove are required in options.\" };\n    if (set !== undefined && (!set || typeof set !== \"object\" || Array.isArray(set) || !Object.values(set).every(item => typeof item === \"string\"))) return { allowed: false, reason: \"The reviewed query parameters to set must be an object of string values.\" };\n    if (remove !== undefined && (!Array.isArray(remove) || !remove.every(item => isnonempty(item)))) return { allowed: false, reason: \"The reviewed query parameters to remove must be a list of non-empty names.\" };\n  }\n  if (step.kind === \"navlist\") {\n    const listcheck = validateurllist(options, \"urls\");\n    if (!listcheck.allowed) return listcheck;\n  }\n  if (step.kind === \"navprofile\") {\n    const profilecheck = validatewaitprofile(options.waitprofile);\n    if (!profilecheck.allowed) return profilecheck;\n  }\n  if (step.kind === \"handleauth\" && !ishttpsurl(step.value)) return { allowed: false, reason: \"A reviewed HTTPS origin or url is required as the auth target.\" };\n  if (step.kind === \"printpdf\" && options.name !== undefined && !isnonempty(options.name)) return { allowed: false, reason: \"The reviewed artifact name must be a non-empty string.\" };\n  if (step.kind === \"prefetch\") {\n    const listcheck = validateurllist(options, \"urls\");\n    if (!listcheck.allowed) return listcheck;\n  }\n  if (step.kind === \"preconnect\") {\n    const origins = options.origins;\n    if (!Array.isArray(origins) || origins.length === 0 || !origins.every(originurl => ishttpsurl(originurl))) return { allowed: false, reason: \"A reviewed non-empty list of HTTPS origins is required in options.\" };\n  }\n  if (step.kind === \"reopentab\" && step.value !== undefined && !ishttpsurl(step.value)) return { allowed: false, reason: \"The reviewed reopen url must use HTTPS.\" };\n  if (step.kind === \"navrate\") {\n    const limitcheck = validateratelimit(options.ratelimit);\n    if (!limitcheck.allowed) return limitcheck;\n  }\n  if (step.kind === \"checksafe\" && !ishttpsurl(step.value)) return { allowed: false, reason: \"A reviewed HTTPS url is required for the safety check.\" };\n  if (step.kind === \"batchopen\") {\n    const listcheck = validateurllist(options, \"urls\");\n    if (!listcheck.allowed) return listcheck;\n  }\n  return { allowed: true };\n}\n\n/** Shared session gate: a live, unpaused session that still matches the active tab. */\nfunction sessiongate(input: { session: agentsession | undefined; tabid: number; origin: string; now: number; action: string }): policyevaluation {\n  if (!input.session || input.session.stoppedat) return { allowed: false, reason: \"No active browser session exists.\" };\n  if (input.session.expiresat <= input.now) return { allowed: false, reason: \"The browser session has expired.\" };\n  if (input.session.pausedat) return { allowed: false, reason: `The browser session is paused and cannot ${input.action}.` };\n  if (input.session.tabid !== input.tabid || input.session.origin !== input.origin) return { allowed: false, reason: `The ${input.action} is outside the approved tab or origin.` };\n  return { allowed: true };\n}\n\n/** Applies the consent gate immediately before an action reaches the page bridge. */\nexport function canexecute(input: { session: agentsession | undefined; plan: agentplan | undefined; step: toolstep; tabid: number; origin: string; now?: number; verdicts?: safetyverdict[] }): policyevaluation {\n  const now = input.now ?? Date.now();\n  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: \"execute an action\" });\n  if (!gate.allowed) return gate;\n  if (!input.plan || input.plan.state !== \"approved\") return { allowed: false, reason: \"The plan has not received explicit approval.\" };\n  if (input.plan.expiresat <= now) return { allowed: false, reason: \"The approved plan has expired.\" };\n  if ((input.step.kind === \"pierceshadow\" || input.step.kind === \"enterframe\") && !origingranted(input.session, input.origin)) return { allowed: false, reason: \"The shadow or frame step is outside the session origin grants.\" };\n  if (input.step.kind === \"readjson\" && !origingranted(input.session, input.origin)) return { allowed: false, reason: \"The json state read is outside the session origin grants.\" };\n  if (input.step.kind === \"navlist\") {\n    let options: Record<string, unknown> = {};\n    try { options = parseoptions(input.step); } catch { options = {}; }\n    for (const url of Array.isArray(options.urls) ? options.urls : []) {\n      if (typeof url !== \"string\") continue;\n      const navigation = navigationgranted(input.session, url);\n      if (!navigation.allowed) return navigation;\n    }\n  }\n  if (input.step.kind === \"openlink\" || input.step.kind === \"openprivate\" || input.step.kind === \"batchopen\" || input.step.kind === \"prefetch\" || input.step.kind === \"deeplink\" || input.step.kind === \"reopentab\") {\n    let options: Record<string, unknown> = {};\n    try { options = parseoptions(input.step); } catch { options = {}; }\n    const grammar = validatestep(input.step, input.origin);\n    if (!grammar.allowed) return grammar;\n    const grants = input.session?.grants ?? [input.session?.origin ?? input.origin];\n    const targets: unknown[] = input.step.kind === \"batchopen\" || input.step.kind === \"prefetch\" ? (Array.isArray(options.urls) ? options.urls : []) : input.step.kind === \"reopentab\" ? [input.step.value] : [(options.navtarget as Record<string, unknown> | undefined)?.url];\n    for (const target of targets) {\n      if (typeof target !== \"string\" || !target) continue;\n      const verified = originverified(target, grants, input.verdicts ?? []);\n      if (!verified.allowed) return verified;\n    }\n  }\n  return validatestep(input.step, input.origin);\n}\n\n/** Allows a non-mutating, temporary target preview during plan review. */\nexport function canpreview(input: { session: agentsession | undefined; plan: agentplan | undefined; step: toolstep; tabid: number; origin: string; now?: number }): policyevaluation {\n  const now = input.now ?? Date.now();\n  const gate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: \"preview a target\" });\n  if (!gate.allowed) return gate;\n  if (!input.plan || ![\"pending\", \"approved\"].includes(input.plan.state)) return { allowed: false, reason: \"Only a reviewed pending or approved plan can be previewed.\" };\n  if (input.plan.expiresat <= now) return { allowed: false, reason: \"The reviewed plan has expired.\" };\n  let options: Record<string, unknown> = {};\n  try { options = parseoptions(input.step); } catch { options = {}; }\n  if (!targetactions.has(input.step.kind) && options.targetref === undefined) return { allowed: false, reason: \"Only a target-based action can be previewed.\" };\n  return validatestep(input.step, input.origin);\n}\n", "import { hostpattern, normalizeendpoint } from \"../policy.js\";\nimport type { capabilityreport, dialogdecision, keyholdstate, navqueues, navstate, waitprofilerecord } from \"../types.js\";\n\ntype pagesignallike = { language?: string; template?: string; scrolllocked?: boolean; banner?: string };\n\nconst endpointinput = document.querySelector<HTMLInputElement>(\"#endpoint\");\nconst statusnode = document.querySelector<HTMLElement>(\"#status\");\nconst capabilitiesnode = document.querySelector<HTMLElement>(\"#capabilities\");\nconst livenode = document.querySelector<HTMLElement>(\"#livelogic\");\nconst navstatenode = document.querySelector<HTMLElement>(\"#navstate\");\nconst connectbutton = document.querySelector<HTMLButtonElement>(\"#connect\");\nconst sessionbutton = document.querySelector<HTMLButtonElement>(\"#session\");\nconst pausebutton = document.querySelector<HTMLButtonElement>(\"#pause\");\nconst stopbutton = document.querySelector<HTMLButtonElement>(\"#stop\");\nconst openbutton = document.querySelector<HTMLButtonElement>(\"#openpanel\");\n\nfunction status(message: string, error = false): void { if (statusnode) { statusnode.textContent = message; statusnode.dataset.state = error ? \"error\" : \"ready\"; } }\nasync function request(message: unknown): Promise<unknown> { const response = await chrome.runtime.sendMessage(message) as { ok: boolean; value?: unknown; error?: string }; if (!response.ok) throw new Error(response.error); return response.value; }\n\nfunction pauselabel(paused: boolean): string { return paused ? \"Resume session\" : \"Pause session\"; }\n\n/** Renders the live optional capability set the user has granted. */\nfunction rendercapabilities(report?: capabilityreport): void {\n  if (!capabilitiesnode) return;\n  if (!report) { capabilitiesnode.textContent = \"Capabilities unknown.\"; return; }\n  const granted = [`tabs ${report.tabs ? \"granted\" : \"absent\"}`, `downloads ${report.downloads ? \"granted\" : \"absent\"}`, `clipboard read ${report.clipboardread ? \"granted\" : \"absent\"}`, `clipboard write ${report.clipboardwrite ? \"granted\" : \"absent\"}`];\n  capabilitiesnode.textContent = `Optional capabilities: ${granted.join(\" \u00B7 \")}.`;\n}\n\n/** Renders the currently held keys and the dialogs answered by the reviewed policy. */\nfunction renderlivestate(holds?: keyholdstate[], dialogs?: dialogdecision[], signals?: pagesignallike): void {\n  if (!livenode) return;\n  const held = (holds ?? []).filter(hold => hold.releasedat === undefined);\n  const heldsummary = held.length > 0 ? held.map(hold => `${hold.key}${hold.holdid ? ` (${hold.holdid})` : \"\"}`).join(\", \") : \"none\";\n  const dialogsummary = (dialogs ?? []).length > 0 ? `${dialogs?.length} answered` : \"none\";\n  const pages = signals && (signals.language !== undefined || signals.template !== undefined || signals.scrolllocked !== undefined)\n    ? [signals.language !== undefined ? `language ${signals.language || \"unknown\"}` : \"\", signals.template !== undefined ? `template ${signals.template}` : \"\", signals.scrolllocked !== undefined ? `scroll lock ${signals.scrolllocked ? \"on\" : \"off\"}` : \"\"].filter(Boolean).join(\" \u00B7 \")\n    : \"unknown\";\n  livenode.textContent = `Held keys: ${heldsummary} \u00B7 Open dialogs answered: ${dialogsummary} \u00B7 Page signals: ${pages}.`;\n}\n\n/** Renders the load phase, offline state, active wait profile and queued navigation targets of the session tab. */\nfunction rendernavstate(state?: navstate, offline?: boolean, profile?: waitprofilerecord, queues?: navqueues): void {\n  if (!navstatenode) return;\n  const phase = state?.phase ? `load phase ${state.phase}` : \"load phase unknown\";\n  const offlinestate = offline === undefined ? \"connectivity unknown\" : offline ? \"offline\" : \"online\";\n  const wait = profile ? `wait profile ${profile.profile.signals.join(\"+\")}` : \"no wait profile\";\n  const queued = queues ? `queued targets ${queues.prefetch + queues.batchopen} (${queues.prefetch} prefetch \u00B7 ${queues.batchopen} batch open)` : \"no queued targets\";\n  navstatenode.textContent = `Navigation: ${phase} \u00B7 ${offlinestate} \u00B7 ${wait} \u00B7 ${queued}.`;\n}\n\nasync function restore(): Promise<void> {\n  const context = await request({ kind: \"context\" }) as { config?: { endpoint: string }; session?: { stoppedat?: number; pausedat?: number; expiresat: number }; capabilities?: capabilityreport; holds?: { heldkeys: keyholdstate[] }; dialogs?: dialogdecision[]; signals?: pagesignallike; navstate?: navstate; offline?: boolean; waitprofile?: waitprofilerecord; navqueues?: navqueues };\n  if (endpointinput && context.config) endpointinput.value = context.config.endpoint;\n  rendercapabilities(context.capabilities);\n  renderlivestate(context.holds?.heldkeys, context.dialogs, context.signals);\n  rendernavstate(context.navstate, context.offline, context.waitprofile, context.navqueues);\n  const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();\n  if (pausebutton) { pausebutton.disabled = !active; pausebutton.textContent = pauselabel(Boolean(context.session?.pausedat)); }\n  if (active && context.session?.pausedat) status(\"Session paused. Reviewed actions are blocked until resume.\");\n  else status(active ? \"Session active. Review the plan in the side panel.\" : \"No active browser session.\");\n}\n\nconnectbutton?.addEventListener(\"click\", async () => {\n  try {\n    const config = normalizeendpoint(endpointinput?.value ?? \"\");\n    const granted = await chrome.permissions.request({ origins: [hostpattern(config.origin)] });\n    if (!granted) throw new Error(\"Origin permission was not granted.\");\n    await request({ kind: \"configure\", endpoint: config.endpoint });\n    status(`Endpoint approved for ${config.origin}.`);\n  } catch (error) { status(error instanceof Error ? error.message : String(error), true); }\n});\nsessionbutton?.addEventListener(\"click\", async () => { try { await request({ kind: \"startsession\" }); status(\"Session started for the active HTTPS tab.\"); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\npausebutton?.addEventListener(\"click\", async () => { try { const context = await request({ kind: \"context\" }) as { session?: { pausedat?: number } }; await request({ kind: context.session?.pausedat ? \"resumesession\" : \"pausesession\" }); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\nstopbutton?.addEventListener(\"click\", async () => { try { await request({ kind: \"stop\" }); status(\"Session stopped. No action can continue.\"); await restore(); } catch (error) { status(error instanceof Error ? error.message : String(error), true); } });\nopenbutton?.addEventListener(\"click\", () => chrome.sidePanel.open({ windowId: chrome.windows.WINDOW_ID_CURRENT }));\nrestore().catch(error => status(error instanceof Error ? error.message : String(error), true));\n"],
+  "mappings": ";AAEA,IAAM,mBAAmB,oBAAI,IAAgB,CAAC,SAAS,QAAQ,YAAY,UAAU,YAAY,QAAQ,QAAQ,UAAU,SAAS,SAAS,WAAW,UAAU,UAAU,UAAU,QAAQ,WAAW,gBAAgB,gBAAgB,mBAAmB,YAAY,aAAa,eAAe,YAAY,aAAa,gBAAgB,eAAe,gBAAgB,gBAAgB,cAAc,cAAc,iBAAiB,cAAc,YAAY,cAAc,YAAY,YAAY,WAAW,cAAc,gBAAgB,eAAe,eAAe,aAAa,WAAW,YAAY,YAAY,eAAe,eAAe,WAAW,cAAc,UAAU,gBAAgB,eAAe,WAAW,cAAc,cAAc,YAAY,YAAY,cAAc,YAAY,aAAa,YAAY,WAAW,iBAAiB,WAAW,CAAC;AAC11B,IAAM,qBAAqB,oBAAI,IAAgB,CAAC,SAAS,UAAU,SAAS,aAAa,cAAc,eAAe,cAAc,YAAY,aAAa,aAAa,cAAc,WAAW,eAAe,aAAa,aAAa,aAAa,iBAAiB,gBAAgB,aAAa,CAAC;AACxS,IAAM,cAAc,oBAAI,IAAgB,CAAC,WAAW,WAAW,WAAW,QAAQ,WAAW,YAAY,iBAAiB,aAAa,gBAAgB,aAAa,YAAY,YAAY,iBAAiB,aAAa,aAAa,cAAc,YAAY,aAAa,eAAe,aAAa,WAAW,cAAc,eAAe,aAAa,iBAAiB,iBAAiB,gBAAgB,YAAY,eAAe,cAAc,eAAe,gBAAgB,YAAY,eAAe,aAAa,eAAe,wBAAwB,iBAAiB,cAAc,iBAAiB,YAAY,eAAe,cAAc,cAAc,cAAc,gBAAgB,sBAAsB,iBAAiB,iBAAiB,cAAc,gBAAgB,oBAAoB,iBAAiB,kBAAkB,kBAAkB,YAAY,WAAW,WAAW,cAAc,iBAAiB,gBAAgB,cAAc,aAAa,WAAW,CAAC;AACp8B,IAAM,iBAAiB,oBAAI,IAAgB,CAAC,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,WAAW,CAAC;AAMhG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAW,IAAI,IAAI,MAAM,KAAK,CAAC;AACrC,MAAI,SAAS,aAAa,SAAU,OAAM,IAAI,MAAM,wCAAwC;AAC5F,MAAI,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,MAAM,kDAAkD;AAC9G,SAAO,EAAE,UAAU,SAAS,SAAS,GAAG,QAAQ,SAAS,QAAQ,cAAc,KAAK,IAAI,EAAE;AAC5F;AAGO,SAAS,YAAY,QAAwB;AAClD,QAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,MAAI,OAAO,aAAa,SAAU,OAAM,IAAI,MAAM,oCAAoC;AACtF,SAAO,GAAG,OAAO,MAAM;AACzB;;;AClBA,IAAM,gBAAgB,SAAS,cAAgC,WAAW;AAC1E,IAAM,aAAa,SAAS,cAA2B,SAAS;AAChE,IAAM,mBAAmB,SAAS,cAA2B,eAAe;AAC5E,IAAM,WAAW,SAAS,cAA2B,YAAY;AACjE,IAAM,eAAe,SAAS,cAA2B,WAAW;AACpE,IAAM,gBAAgB,SAAS,cAAiC,UAAU;AAC1E,IAAM,gBAAgB,SAAS,cAAiC,UAAU;AAC1E,IAAM,cAAc,SAAS,cAAiC,QAAQ;AACtE,IAAM,aAAa,SAAS,cAAiC,OAAO;AACpE,IAAM,aAAa,SAAS,cAAiC,YAAY;AAEzE,SAAS,OAAO,SAAiB,QAAQ,OAAa;AAAE,MAAI,YAAY;AAAE,eAAW,cAAc;AAAS,eAAW,QAAQ,QAAQ,QAAQ,UAAU;AAAA,EAAS;AAAE;AACpK,eAAe,QAAQ,SAAoC;AAAE,QAAM,WAAW,MAAM,OAAO,QAAQ,YAAY,OAAO;AAAuD,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,SAAS,KAAK;AAAG,SAAO,SAAS;AAAO;AAEvP,SAAS,WAAW,QAAyB;AAAE,SAAO,SAAS,mBAAmB;AAAiB;AAGnG,SAAS,mBAAmB,QAAiC;AAC3D,MAAI,CAAC,iBAAkB;AACvB,MAAI,CAAC,QAAQ;AAAE,qBAAiB,cAAc;AAAyB;AAAA,EAAQ;AAC/E,QAAM,UAAU,CAAC,QAAQ,OAAO,OAAO,YAAY,QAAQ,IAAI,aAAa,OAAO,YAAY,YAAY,QAAQ,IAAI,kBAAkB,OAAO,gBAAgB,YAAY,QAAQ,IAAI,mBAAmB,OAAO,iBAAiB,YAAY,QAAQ,EAAE;AACzP,mBAAiB,cAAc,0BAA0B,QAAQ,KAAK,QAAK,CAAC;AAC9E;AAGA,SAAS,gBAAgB,OAAwB,SAA4B,SAAgC;AAC3G,MAAI,CAAC,SAAU;AACf,QAAM,QAAQ,SAAS,CAAC,GAAG,OAAO,UAAQ,KAAK,eAAe,MAAS;AACvE,QAAM,cAAc,KAAK,SAAS,IAAI,KAAK,IAAI,UAAQ,GAAG,KAAK,GAAG,GAAG,KAAK,SAAS,KAAK,KAAK,MAAM,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI,IAAI;AAC5H,QAAM,iBAAiB,WAAW,CAAC,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,cAAc;AACnF,QAAM,QAAQ,YAAY,QAAQ,aAAa,UAAa,QAAQ,aAAa,UAAa,QAAQ,iBAAiB,UACnH,CAAC,QAAQ,aAAa,SAAY,YAAY,QAAQ,YAAY,SAAS,KAAK,IAAI,QAAQ,aAAa,SAAY,YAAY,QAAQ,QAAQ,KAAK,IAAI,QAAQ,iBAAiB,SAAY,eAAe,QAAQ,eAAe,OAAO,KAAK,KAAK,EAAE,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK,IACpR;AACJ,WAAS,cAAc,cAAc,WAAW,gCAA6B,aAAa,uBAAoB,KAAK;AACrH;AAGA,SAAS,eAAe,OAAkB,SAAmB,SAA6B,QAA0B;AAClH,MAAI,CAAC,aAAc;AACnB,QAAM,QAAQ,OAAO,QAAQ,cAAc,MAAM,KAAK,KAAK;AAC3D,QAAM,eAAe,YAAY,SAAY,yBAAyB,UAAU,YAAY;AAC5F,QAAM,OAAO,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,KAAK,GAAG,CAAC,KAAK;AAC7E,QAAM,SAAS,SAAS,kBAAkB,OAAO,WAAW,OAAO,SAAS,KAAK,OAAO,QAAQ,kBAAe,OAAO,SAAS,iBAAiB;AAChJ,eAAa,cAAc,eAAe,KAAK,SAAM,YAAY,SAAM,IAAI,SAAM,MAAM;AACzF;AAEA,eAAe,UAAyB;AACtC,QAAM,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,CAAC;AACjD,MAAI,iBAAiB,QAAQ,OAAQ,eAAc,QAAQ,QAAQ,OAAO;AAC1E,qBAAmB,QAAQ,YAAY;AACvC,kBAAgB,QAAQ,OAAO,UAAU,QAAQ,SAAS,QAAQ,OAAO;AACzE,iBAAe,QAAQ,UAAU,QAAQ,SAAS,QAAQ,aAAa,QAAQ,SAAS;AACxF,QAAM,SAAS,QAAQ,WAAW,CAAC,QAAQ,QAAQ,aAAa,QAAQ,QAAQ,YAAY,KAAK,IAAI;AACrG,MAAI,aAAa;AAAE,gBAAY,WAAW,CAAC;AAAQ,gBAAY,cAAc,WAAW,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,EAAG;AAC7H,MAAI,UAAU,QAAQ,SAAS,SAAU,QAAO,4DAA4D;AAAA,MACvG,QAAO,SAAS,uDAAuD,4BAA4B;AAC1G;AAEA,eAAe,iBAAiB,SAAS,YAAY;AACnD,MAAI;AACF,UAAM,SAAS,kBAAkB,eAAe,SAAS,EAAE;AAC3D,UAAM,UAAU,MAAM,OAAO,YAAY,QAAQ,EAAE,SAAS,CAAC,YAAY,OAAO,MAAM,CAAC,EAAE,CAAC;AAC1F,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAClE,UAAM,QAAQ,EAAE,MAAM,aAAa,UAAU,OAAO,SAAS,CAAC;AAC9D,WAAO,yBAAyB,OAAO,MAAM,GAAG;AAAA,EAClD,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAC1F,CAAC;AACD,eAAe,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,QAAQ,EAAE,MAAM,eAAe,CAAC;AAAG,WAAO,2CAA2C;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AACvQ,aAAa,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,CAAC;AAA0C,UAAM,QAAQ,EAAE,MAAM,QAAQ,SAAS,WAAW,kBAAkB,eAAe,CAAC;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AACzV,YAAY,iBAAiB,SAAS,YAAY;AAAE,MAAI;AAAE,UAAM,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAG,WAAO,0CAA0C;AAAG,UAAM,QAAQ;AAAA,EAAG,SAAS,OAAO;AAAE,WAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI;AAAA,EAAG;AAAE,CAAC;AAC3P,YAAY,iBAAiB,SAAS,MAAM,OAAO,UAAU,KAAK,EAAE,UAAU,OAAO,QAAQ,kBAAkB,CAAC,CAAC;AACjH,QAAQ,EAAE,MAAM,WAAS,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,IAAI,CAAC;",
   "names": []
 }

package/extension/dist/sidepanel.html CHANGED Viewed

@@ -1,5 +1,5 @@
 <!doctype html>
 <html lang="en">
 <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Devthink review</title><link rel="stylesheet" href="style.css"></head>
-<body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
+<body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Navigation trail</h2><ol id="trail" class="audit"></ol></section><section><h2>Navigation state</h2><div id="navigation" class="panel"></div></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
 </html>

package/extension/dist/sidepanel.js CHANGED Viewed

@@ -14,6 +14,8 @@ var streamroot = document.querySelector("#stream");
 var diffsroot = document.querySelector("#diffs");
 var bannersroot = document.querySelector("#banners");
 var selectorsroot = document.querySelector("#selectors");
+var trailroot = document.querySelector("#trail");
+var navigationroot = document.querySelector("#navigation");
 var statusnode = document.querySelector("#status");
 var progressnode = document.querySelector("#planprogress");
 var capabilitiestext = document.querySelector("#capabilitiestext");
@@ -58,7 +60,8 @@ var topictags = [
   { topic: "reads", kinds: ["mapclicks", "verifyvisible", "verifyenabled", "resolvexpath"] },
   { topic: "observation", kinds: ["a11ytree", "readvisible", "readertree", "readoutline", "readselection", "readopengraph", "readlang", "detectlanguage", "listshadow", "listframes", "readscrollpos"] },
   { topic: "detection", kinds: ["detectlists", "detecttables", "detectinfinitescroll", "detectvirtual", "detectlazy", "detectsticky", "detectscrolllock", "countpages", "classifypage", "fingerprintsection"] },
-  { topic: "watch", kinds: ["watchmutate", "watchbanner", "watchfocus", "waitquiet", "readjson", "diffsnapshots", "deriveselector"] }
+  { topic: "watch", kinds: ["watchmutate", "watchbanner", "watchfocus", "waitquiet", "readjson", "diffsnapshots", "deriveselector"] },
+  { topic: "navigation", kinds: ["openlink", "openprivate", "reloadcache", "stopnav", "waitload", "waiturl", "followlink", "spanav", "spawait", "rewritequery", "setfragment", "navlist", "navprofile", "detecthttp", "readredirects", "readfinalurl", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "trailaudit", "pausenav", "navintent", "navrate", "openclipboard", "checksafe", "batchopen"] }
 ];
 function steptopic(kind) {
   return topictags.find((tag) => tag.kinds.includes(kind))?.topic;
@@ -113,6 +116,29 @@ function quietdetail(step, outcomes) {
   node.textContent = `network quiet: ${samples.length} sample${samples.length === 1 ? "" : "s"} \xB7 quiet for ${Math.round(last?.quietfor ?? 0)} ms \xB7 idle threshold ${idle} ms \xB7 ${latest.ok ? "quiet reached" : "still busy"}`;
   return node;
 }
+function navlistdetail(step, progress, outcomes) {
+  if (step.kind !== "navlist") return null;
+  const entries = (progress?.outcomes ?? []).filter((outcome) => outcome.stepid === step.id && outcome.details?.naventry !== void 0).map((outcome) => outcome.details?.naventry);
+  const total = entries.length > 0 ? Math.max(...entries.map((entry) => entry.index)) + 1 : 0;
+  const latestoutcome = [...outcomes].reverse().find((outcome) => outcome.stepid === step.id);
+  const remaining = typeof latestoutcome?.details?.remaining === "number" ? latestoutcome.details?.remaining : 0;
+  const current = entries[entries.length - 1];
+  const node = document.createElement("p");
+  node.className = "timeline";
+  node.textContent = entries.length === 0 ? "navigation list: no entry completed yet" : `navigation list: ${entries.filter((entry) => entry.ok).length} of ${total} entries completed \xB7 current url ${current?.url ?? ""} \xB7 ${remaining} remaining`;
+  return node;
+}
+function redirectdetail(step, outcomes) {
+  if (!["navigate", "followlink", "spanav", "navlist", "openlink", "reloadcache"].includes(step.kind)) return null;
+  const latest = [...outcomes].reverse().find((outcome) => outcome.stepid === step.id && outcome.details?.hops !== void 0);
+  if (!latest) return null;
+  const hops = typeof latest.details?.hops === "number" ? latest.details?.hops : 0;
+  const final = typeof latest.details?.finalurl === "string" ? latest.details?.finalurl : "";
+  const node = document.createElement("p");
+  node.className = "timeline";
+  node.textContent = `redirects: ${Math.max(0, hops - 1)} hop${hops - 1 === 1 ? "" : "s"} \xB7 final url ${final || "unknown"}`;
+  return node;
+}
 function renderpreview(step) {
   const preview = previews.get(step.id);
   if (!preview) return null;
@@ -138,7 +164,7 @@ function renderpreview(step) {
   }
   return node;
 }
-function stepitem(plan, step, completed, outcomes, retries) {
+function stepitem(plan, step, completed, outcomes, retries, progress) {
   const item = document.createElement("li");
   const done = completed.includes(step.id);
   item.textContent = `${done ? "\u2713" : ""} ${step.summary}${holddetail(step)}`;
@@ -146,6 +172,10 @@ function stepitem(plan, step, completed, outcomes, retries) {
   if (outcome) item.append(outcome);
   const timeline = step.kind === "retryaction" ? retrydetail(step, retries) : quietdetail(step, outcomes);
   if (timeline) item.append(timeline);
+  const navlist = navlistdetail(step, progress, outcomes);
+  if (navlist) item.append(navlist);
+  const redirects = redirectdetail(step, outcomes);
+  if (redirects) item.append(redirects);
   const preview = renderpreview(step);
   if (preview) item.append(preview);
   const hastarget = Boolean(step.target) || options(step).targetref !== void 0;
@@ -162,7 +192,7 @@ function stepitem(plan, step, completed, outcomes, retries) {
   }));
   return item;
 }
-function steplist(plan, steps, completed, outcomes, retries, risk) {
+function steplist(plan, steps, completed, outcomes, retries, risk, progress) {
   const group = steps.filter((step) => step.risk === risk);
   if (group.length === 0) return null;
   const section = document.createElement("section");
@@ -172,7 +202,7 @@ function steplist(plan, steps, completed, outcomes, retries, risk) {
   const general = group.filter((step) => steptopic(step.kind) === void 0);
   if (general.length > 0) {
     const list = document.createElement("ol");
-    for (const step of general) list.append(stepitem(plan, step, completed, outcomes, retries));
+    for (const step of general) list.append(stepitem(plan, step, completed, outcomes, retries, progress));
     section.append(list);
   }
   for (const tag of topictags) {
@@ -182,7 +212,7 @@ function steplist(plan, steps, completed, outcomes, retries, risk) {
     row.textContent = `${tag.topic} steps`;
     section.append(row);
     const list = document.createElement("ol");
-    for (const step of tagged) list.append(stepitem(plan, step, completed, outcomes, retries));
+    for (const step of tagged) list.append(stepitem(plan, step, completed, outcomes, retries, progress));
     section.append(list);
   }
   return section;
@@ -200,9 +230,9 @@ function renderplan(plan, progress, outcomes = [], retries = []) {
   planroot.append(title);
   const completed = progress?.planid === plan.id ? progress.completedsteps : [];
   renderprogress(plan, completed);
-  const sensitive = steplist(plan, plan.steps, completed, outcomes, retries, "sensitive");
-  const interaction = steplist(plan, plan.steps, completed, outcomes, retries, "interaction");
-  const read = steplist(plan, plan.steps, completed, outcomes, retries, "read");
+  const sensitive = steplist(plan, plan.steps, completed, outcomes, retries, "sensitive", progress);
+  const interaction = steplist(plan, plan.steps, completed, outcomes, retries, "interaction", progress);
+  const read = steplist(plan, plan.steps, completed, outcomes, retries, "read", progress);
   for (const group of [sensitive, interaction, read]) if (group) planroot.append(group);
   if (plan.state === "pending") {
     planroot.append(button("Approve reviewed plan", async () => {
@@ -400,6 +430,155 @@ function renderselectors(selectors) {
     selectorsroot.append(item);
   }
 }
+function rendertrail(trail) {
+  if (!trailroot) return;
+  trailroot.replaceChildren();
+  if (trail.length === 0) {
+    trailroot.textContent = "No page has been visited inside a reviewed navigation step yet.";
+    return;
+  }
+  for (const entry of [...trail].reverse().slice(0, 12)) {
+    const item = document.createElement("li");
+    item.textContent = `${new Date(entry.at).toLocaleTimeString()} \xB7 ${entry.url}${entry.title ? ` \xB7 ${entry.title}` : ""}${entry.stepid ? ` \xB7 step ${entry.stepid}` : ""}`;
+    trailroot.append(item);
+  }
+}
+function rendernavigation(context) {
+  if (!navigationroot) return;
+  navigationroot.replaceChildren();
+  const paused = document.createElement("p");
+  if (context.navcontrol?.pausedat) {
+    paused.className = "bannercard";
+    paused.textContent = `Navigation is paused while ${context.navcontrol.reason ?? "a consent prompt is open"}; reviewed navigation steps are blocked until it resumes.`;
+  } else {
+    paused.textContent = "Navigation is live; no consent prompt holds it.";
+  }
+  navigationroot.append(paused);
+  const rates = context.ratestates ?? [];
+  if (rates.length > 0) {
+    const heading = document.createElement("p");
+    heading.textContent = "rate limit windows per domain:";
+    navigationroot.append(heading);
+    const list = document.createElement("ul");
+    for (const state of rates.slice(0, 6)) {
+      const item = document.createElement("li");
+      item.textContent = `${state.domain}: ${state.count} of ${state.limit.ceiling} navigations inside the reviewed window of ${state.limit.window} ms`;
+      list.append(item);
+    }
+    navigationroot.append(list);
+  }
+  const records = context.navrecords ?? [];
+  const record = records[0];
+  if (record) {
+    const chain = document.createElement("p");
+    chain.textContent = `latest navigation: ${Math.max(0, record.chain.hops.length - 1)} redirect${record.chain.hops.length - 1 === 1 ? "" : "s"} \xB7 final url ${record.finalurl}`;
+    navigationroot.append(chain);
+    const hops = document.createElement("ul");
+    for (const hop of record.chain.hops.slice(0, 6)) {
+      const item = document.createElement("li");
+      let path = hop.url;
+      try {
+        path = new URL(hop.url).pathname;
+      } catch {
+        path = hop.url;
+      }
+      item.textContent = `hop ${path} \xB7 status ${hop.status} \xB7 ${new Date(hop.at).toLocaleTimeString()}`;
+      hops.append(item);
+    }
+    navigationroot.append(hops);
+  }
+  const curatedlists = context.curated ?? [];
+  if (curatedlists.length > 0) {
+    const heading = document.createElement("p");
+    heading.textContent = "curated link lists with per url safety states:";
+    navigationroot.append(heading);
+    for (const list of curatedlists.slice(0, 3)) {
+      const card = document.createElement("div");
+      card.className = "bannercard";
+      const title = document.createElement("p");
+      title.textContent = `${list.links.length} curated url${list.links.length === 1 ? "" : "s"}${list.reviewedat ? " \xB7 opened after review" : " \xB7 waiting for review"}`;
+      card.append(title);
+      for (const link of list.links.slice(0, 8)) {
+        const line = document.createElement("p");
+        line.textContent = `${link.verdict === "safe" ? "\u2713" : "\u2717"} ${link.url}${link.reasons.length > 0 ? ` \xB7 ${link.reasons.join("; ")}` : ""}`;
+        card.append(line);
+      }
+      navigationroot.append(card);
+    }
+  }
+  const safeties = context.safeties ?? [];
+  const runner = document.createElement("p");
+  const checkinput = document.createElement("input");
+  checkinput.type = "url";
+  checkinput.placeholder = "https://external.example/link";
+  checkinput.setAttribute("aria-label", "url to verify with checksafe");
+  const checkbutton = button("Run checksafe", async () => {
+    const verdict = await request({ kind: "checksafe", url: checkinput.value });
+    status(verdict.safe ? `${verdict.url} passed every safety check.` : `${verdict.url} is unsafe: ${verdict.reasons.join("; ")}.`);
+    await refresh();
+  });
+  runner.append(checkinput, " ", checkbutton);
+  navigationroot.append(runner);
+  if (safeties.length > 0) {
+    const list = document.createElement("ul");
+    for (const verdict of safeties.slice(0, 6)) {
+      const item = document.createElement("li");
+      item.textContent = `${verdict.safe ? "safe" : "unsafe"} \xB7 ${verdict.url}${verdict.reasons.length > 0 ? ` \xB7 ${verdict.reasons.join("; ")}` : ""}`;
+      list.append(item);
+    }
+    navigationroot.append(list);
+  }
+  const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
+  const authcard = document.createElement("div");
+  authcard.className = "bannercard";
+  const authtitle = document.createElement("p");
+  authtitle.textContent = active ? "basic auth credentials (stored only after your explicit review):" : "basic auth credentials need an active session before they can be reviewed.";
+  authcard.append(authtitle);
+  if (active) {
+    const origininput = document.createElement("input");
+    origininput.type = "url";
+    origininput.placeholder = context.session?.origin ?? "https://example.com";
+    origininput.setAttribute("aria-label", "auth origin");
+    const userinput = document.createElement("input");
+    userinput.type = "text";
+    userinput.placeholder = "username";
+    userinput.setAttribute("aria-label", "auth username");
+    const passinput = document.createElement("input");
+    passinput.type = "password";
+    passinput.placeholder = "password";
+    passinput.setAttribute("aria-label", "auth password");
+    const storebutton = button("Store reviewed credentials", async () => {
+      const stored = await request({ kind: "storeauth", origin: origininput.value, username: userinput.value, password: passinput.value });
+      status(`Reviewed basic auth credentials stored for ${stored.origin}.`);
+      await refresh();
+    });
+    authcard.append(origininput, " ", userinput, " ", passinput, " ", storebutton);
+  }
+  navigationroot.append(authcard);
+  const auths = context.auths ?? [];
+  if (auths.length > 0) {
+    const list = document.createElement("ul");
+    for (const record2 of auths.slice(0, 4)) {
+      const item = document.createElement("li");
+      item.textContent = `basic auth for ${record2.origin} as ${record2.username}, reviewed ${new Date(record2.reviewedat).toLocaleString()}`;
+      list.append(item);
+    }
+    navigationroot.append(list);
+  }
+  const artifacts = context.artifacts ?? [];
+  if (artifacts.length > 0) {
+    const heading = document.createElement("p");
+    heading.textContent = "task artifacts:";
+    navigationroot.append(heading);
+    const list = document.createElement("ul");
+    for (const artifact of artifacts.slice(0, 6)) {
+      const item = document.createElement("li");
+      item.textContent = `${artifact.kind}: ${artifact.name} \xB7 step ${artifact.stepid}`;
+      list.append(item);
+    }
+    navigationroot.append(list);
+  }
+}
 function rendercapabilities(report) {
   if (!capabilitiestext) return;
   if (!report) {
@@ -443,6 +622,8 @@ async function refresh() {
   renderdiffs(context.diffs ?? []);
   renderbanners(context.banners ?? []);
   renderselectors(context.selectors ?? []);
+  rendertrail(context.trail?.trail ?? []);
+  rendernavigation(context);
   renderaudit(context.audit);
   rendercapabilities(context.capabilities);
   if (context.session?.pausedat) status("Session paused. Reviewed actions are blocked until resume.");