@wenathlan/extension 1.1.34 → 1.1.36

package/extension/dist/background.js

@@ -238,19 +238,219 @@ var sessionmemory = class {
   async setsignals(signals) {
     return this.adapter.set("signals", signals);
   }
+  /** Appends one navigation trail entry of a session with its url, title, step ref and timestamp. */
+  async addtrailentry(sessionid, entry) {
+    const records = await this.gettrail(sessionid);
+    await this.adapter.set(`trail${sessionid}`, [...records, entry]);
+  }
+  /** Returns the navigation trail of a session, oldest first. */
+  async gettrail(sessionid) {
+    return await this.adapter.get(`trail${sessionid}`) ?? [];
+  }
+  /** Stores one wait profile for an origin with user configured values, replacing the previous profile of that origin. */
+  async setwaitprofile(record2) {
+    const records = (await this.getwaitprofiles()).filter((item) => item.origin !== record2.origin);
+    await this.adapter.set("waitprofiles", [...records, record2]);
+  }
+  /** Returns every stored wait profile with its origin and user configured values, newest first. */
+  async getwaitprofiles() {
+    return await this.adapter.get("waitprofiles") ?? [];
+  }
+  /** Records one navigation step with its redirect chain and final url. */
+  async addnavrecord(record2) {
+    const records = await this.getnavrecords();
+    await this.adapter.set("navrecords", [record2, ...records]);
+  }
+  /** Returns every stored navigation record with redirect chains and final urls, newest first. */
+  async getnavrecords() {
+    return await this.adapter.get("navrecords") ?? [];
+  }
+  /** Records one navigation intent detected from a plan for audit review. */
+  async addnavintent(record2) {
+    const records = await this.getnavintents();
+    await this.adapter.set("navintents", [record2, ...records]);
+  }
+  /** Returns every stored navigation intent record, newest first. */
+  async getnavintents() {
+    return await this.adapter.get("navintents") ?? [];
+  }
+  /** Replaces the rate limit window state of one domain. */
+  async setratestate(state) {
+    const records = (await this.getratestates()).filter((item) => item.domain !== state.domain);
+    await this.adapter.set("ratestates", [...records, state]);
+  }
+  /** Returns every rate limit window state per domain. */
+  async getratestates() {
+    return await this.adapter.get("ratestates") ?? [];
+  }
+  /** Records one curated link list with its review state before batch opening. */
+  async addcurated(list) {
+    const records = await this.getcurateds();
+    await this.adapter.set("curated", [list, ...records]);
+  }
+  /** Returns every stored curated link list, newest first. */
+  async getcurateds() {
+    return await this.adapter.get("curated") ?? [];
+  }
+  /** Stores reviewed basic auth credentials for one origin, replacing the previous record of that origin. */
+  async setauth(record2) {
+    const records = (await this.getauths()).filter((item) => item.origin !== record2.origin);
+    await this.adapter.set("auths", [...records, record2]);
+  }
+  /** Returns every stored reviewed basic auth record per origin. */
+  async getauths() {
+    return await this.adapter.get("auths") ?? [];
+  }
+  /** Records one task artifact routed into the artifact store. */
+  async addartifact(record2) {
+    const records = await this.getartifacts();
+    await this.adapter.set("artifacts", [record2, ...records]);
+  }
+  /** Returns every stored task artifact, newest first. */
+  async getartifacts() {
+    return await this.adapter.get("artifacts") ?? [];
+  }
+  /** Returns the navigation control state of paused navigation. */
+  async getnavcontrol() {
+    return this.adapter.get("navcontrol");
+  }
+  /** Replaces the navigation control state after a pause or resume transition. */
+  async setnavcontrol(control) {
+    return this.adapter.set("navcontrol", control);
+  }
+  /** Records one url safety verdict produced by a checksafe verification. */
+  async addsafety(verdict) {
+    const records = await this.getsafeties();
+    await this.adapter.set("safeties", [verdict, ...records]);
+  }
+  /** Returns every stored url safety verdict, newest first. */
+  async getsafeties() {
+    return await this.adapter.get("safeties") ?? [];
+  }
+  /** Records one recently closed tab so a reopentab step can restore it. */
+  async addrecenttab(tab) {
+    const records = await this.getrecenttabs();
+    await this.adapter.set("recenttabs", [tab, ...records]);
+  }
+  /** Returns every recently closed tab, newest first. */
+  async getrecenttabs() {
+    return await this.adapter.get("recenttabs") ?? [];
+  }
+  /** Returns the queued prefetch and batch open target counts shown in the popup badge. */
+  async getnavqueues() {
+    return this.adapter.get("navqueues");
+  }
+  /** Replaces the queued prefetch and batch open target counts. */
+  async setnavqueues(queues) {
+    return this.adapter.set("navqueues", queues);
+  }
+  /** Returns the last known navigation state of a tab, kept across service worker restarts. */
+  async getnavstate(tabid2) {
+    return this.adapter.get(`navstate${tabid2}`);
+  }
+  /** Replaces the last known navigation state of a tab. */
+  async setnavstate(tabid2, state) {
+    return this.adapter.set(`navstate${tabid2}`, state);
+  }
+  /** Stores one named tab layout with its window bounds and group states, replacing the previous layout of that name. */
+  async setlayout(layout) {
+    const records = (await this.getlayouts()).filter((item) => item.name !== layout.name);
+    await this.adapter.set("layouts", [layout, ...records]);
+  }
+  /** Returns one saved tab layout by name with its timestamp. */
+  async getlayout(name) {
+    return (await this.getlayouts()).find((item) => item.name === name);
+  }
+  /** Returns every saved tab layout with its window bounds and group states. */
+  async getlayouts() {
+    return await this.adapter.get("layouts") ?? [];
+  }
+  /** Stores one tab group definition with its color choice and member tabs, replacing the previous definition of that name. */
+  async settabgroup(group) {
+    const records = (await this.gettabgroups()).filter((item) => item.name !== group.name);
+    await this.adapter.set("tabgroups", [...records, group]);
+  }
+  /** Returns every stored tab group definition with its color choice, newest first. */
+  async gettabgroups() {
+    return await this.adapter.get("tabgroups") ?? [];
+  }
+  /** Records one tabmeta record with task provenance, replacing the previous metadata of that tab. */
+  async settabmeta(meta) {
+    const records = (await this.gettabmetas()).filter((item) => item.tabid !== meta.tabid);
+    await this.adapter.set("tabmetas", [...records, meta]);
+  }
+  /** Returns every stored tabmeta record with task provenance. */
+  async gettabmetas() {
+    return await this.adapter.get("tabmetas") ?? [];
+  }
+  /** Records one session snapshot of tabs and windows for later restore. */
+  async addsnapshot(snapshot2) {
+    const records = await this.getsnapshots();
+    await this.adapter.set("snapshots", [snapshot2, ...records]);
+  }
+  /** Returns every stored session snapshot, newest first. */
+  async getsnapshots() {
+    return await this.adapter.get("snapshots") ?? [];
+  }
+  /** Records one closed tab in the history kept for restoretab and reopenrun. */
+  async addclosedtab(tab) {
+    const records = await this.getclosedtabs();
+    await this.adapter.set("closedtabs", [tab, ...records]);
+  }
+  /** Returns the closed tab history, newest first. */
+  async getclosedtabs() {
+    return await this.adapter.get("closedtabs") ?? [];
+  }
+  /** Stores one badge state per task, replacing the previous badge of that task. */
+  async setbadge(badge) {
+    const records = (await this.getbadges()).filter((item) => item.taskid !== badge.taskid);
+    await this.adapter.set("badges", [...records, badge]);
+  }
+  /** Returns every stored badge state per task. */
+  async getbadges() {
+    return await this.adapter.get("badges") ?? [];
+  }
+  /** Records one tab event observed inside a reviewed watchtab registration. */
+  async addtabwatchevent(event) {
+    const records = await this.gettabwatchevents();
+    await this.adapter.set("tabwatchevents", [event, ...records]);
+  }
+  /** Returns the tab event stream of every reviewed watchtab registration, newest first. */
+  async gettabwatchevents() {
+    return await this.adapter.get("tabwatchevents") ?? [];
+  }
+  /** Returns the ids of the scratch windows opened for split work. */
+  async getscratchwindows() {
+    return await this.adapter.get("scratchwindows") ?? [];
+  }
+  /** Replaces the scratch window id list after one scratch window opens or closes. */
+  async setscratchwindows(ids) {
+    return this.adapter.set("scratchwindows", ids);
+  }
+  /** Returns the pinned control tab state with the live task feed. */
+  async getcontroltab() {
+    return this.adapter.get("controltab");
+  }
+  /** Replaces the pinned control tab state. */
+  async setcontroltab(state) {
+    return this.adapter.set("controltab", state);
+  }
 };
 function randomid() {
   return crypto.randomUUID();
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
-var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus"]);
+var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection"]);
-var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor"]);
+var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow"]);
+var tabscommandactions = /* @__PURE__ */ new Set(["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"]);
+var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
+var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
 function normalizeendpoint(value) {
   const endpoint = new URL(value.trim());
   if (endpoint.protocol !== "https:") throw new Error("Devthink accepts HTTPS endpoints only.");
@@ -281,8 +481,29 @@ function parseoptions(step) {
 function requiredcapability(kind) {
   if (kind === "tablist") return "tabs";
   if (kind === "downloadfile") return "downloads";
+  if (kind === "openclipboard") return "clipboardRead";
+  if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
+  if (tabscommandactions.has(kind)) return "tabs";
   return void 0;
 }
+function istabscommandkind(kind) {
+  return tabscommandactions.has(kind);
+}
+function islayoutkind(kind) {
+  return layoutmutationactions.has(kind);
+}
+function layoutmutationgranted(session, now) {
+  if (!session || session.stoppedat || session.expiresat <= now) return { allowed: false, reason: "Group and layout mutations stay inside the active session." };
+  return { allowed: true };
+}
+function windowclosegate(tasktabcount, reviewed) {
+  if (tasktabcount > 1 && !reviewed) return { allowed: false, reason: `The window holds ${tasktabcount} task tabs and needs explicit review before it closes.` };
+  return { allowed: true };
+}
+function tasktabceiling(settings) {
+  const ceiling = settings?.tasktabceiling;
+  return typeof ceiling === "number" && Number.isFinite(ceiling) && ceiling >= 0 ? ceiling : void 0;
+}
 function waitduration(step) {
   const requested = step.value ? Number.parseInt(step.value, 10) : 250;
   if (!Number.isFinite(requested) || requested < 0) throw new Error("Wait duration must be zero or a positive number of milliseconds.");
@@ -331,6 +552,35 @@ function origingranted(session, origin) {
   const grants = session.grants ?? [session.origin];
   return grants.includes(origin);
 }
+function originverified(url, grants, verdicts) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return { allowed: false, reason: "The reviewed navigation URL is invalid." };
+  }
+  if (grants.includes(origin)) return { allowed: true };
+  const covered = verdicts.find((verdict) => verdict.safe && (verdict.url === url || safeorigin(verdict.url) === origin));
+  if (covered) return { allowed: true };
+  return { allowed: false, reason: `The origin ${origin} is outside the session grants and has no safe checksafe verdict; run checksafe and review it first.` };
+}
+function safeorigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "";
+  }
+}
+function navigationgranted(session, url) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return { allowed: false, reason: "The reviewed navigation URL is invalid." };
+  }
+  if (origingranted(session, origin)) return { allowed: true };
+  return { allowed: false, reason: `Navigation to ${origin} leaves the task tab origins and needs the user consent of a session grant first.` };
+}
 function validateinnerstep(options, origin) {
   const stepid = options.stepid;
   const kind = options.kind;
@@ -354,6 +604,166 @@ function validateinnerstep(options, origin) {
   };
   return validatestep(inner, origin);
 }
+function ishttpsurl(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function validatenavtarget(value, kind) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed navtarget with a url is required in options." };
+  const target = value;
+  if (!ishttpsurl(target.url)) return { allowed: false, reason: "The reviewed navtarget url must use HTTPS." };
+  const container = target.container ?? "tab";
+  if (container !== "current" && container !== "tab" && container !== "window" && container !== "private") return { allowed: false, reason: "The reviewed navtarget container must be current, tab, window or private." };
+  if (target.position !== void 0 && target.position !== "adjacent" && target.position !== "end") return { allowed: false, reason: "The reviewed navtarget position must be adjacent or end." };
+  if (kind === "openprivate" && container !== "private") return { allowed: false, reason: "The openprivate step requires the private container." };
+  if (kind === "openlink" && container === "private") return { allowed: false, reason: "The openlink step cannot open the private container; use openprivate." };
+  return { allowed: true };
+}
+function validatewaitprofile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed waitprofile with load signals is required in options." };
+  const profile = value;
+  if (!Array.isArray(profile.signals) || profile.signals.length === 0 || !profile.signals.every((signal) => isnonempty(signal))) return { allowed: false, reason: "The reviewed waitprofile needs a non-empty list of load signals." };
+  if (!nonnegativeoption(profile, "idle")) return { allowed: false, reason: "The reviewed waitprofile idle threshold must be zero or a positive number of milliseconds." };
+  if (!nonnegativeoption(profile, "timeout")) return { allowed: false, reason: "The reviewed waitprofile timeout must be zero or a positive number of milliseconds." };
+  if (profile.overrides !== void 0) {
+    if (!Array.isArray(profile.overrides) || profile.overrides.length === 0) return { allowed: false, reason: "The reviewed waitprofile overrides must be a non-empty list when present." };
+    for (const entry of profile.overrides) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) return { allowed: false, reason: "Every reviewed waitprofile override must be an object with an origin." };
+      const override = entry;
+      if (!ishttpsurl(override.origin)) return { allowed: false, reason: "Every reviewed waitprofile override origin must use HTTPS." };
+      if (override.signals !== void 0 && (!Array.isArray(override.signals) || !override.signals.every((signal) => isnonempty(signal)))) return { allowed: false, reason: "The reviewed waitprofile override signals must be a list of non-empty strings." };
+      if (!nonnegativeoption(override, "idle") || !nonnegativeoption(override, "timeout")) return { allowed: false, reason: "The reviewed waitprofile override thresholds must be zero or positive numbers." };
+    }
+  }
+  return { allowed: true };
+}
+function validateurlpattern(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed urlpattern is required in options." };
+  const pattern = value;
+  if (pattern.mode !== "exact" && pattern.mode !== "prefix" && pattern.mode !== "host" && pattern.mode !== "pattern") return { allowed: false, reason: "The reviewed urlpattern mode must be exact, prefix, host or pattern." };
+  if (!ishttpsurl(pattern.url)) return { allowed: false, reason: "The reviewed urlpattern url must use HTTPS." };
+  if (pattern.query !== void 0) {
+    if (!pattern.query || typeof pattern.query !== "object" || Array.isArray(pattern.query)) return { allowed: false, reason: "The reviewed urlpattern query part must be an object of parameter names and values." };
+    for (const item of Object.values(pattern.query)) if (typeof item !== "string") return { allowed: false, reason: "The reviewed urlpattern query values must be strings." };
+  }
+  if (pattern.fragment !== void 0 && !isnonempty(pattern.fragment)) return { allowed: false, reason: "The reviewed urlpattern fragment must be a non-empty string." };
+  return { allowed: true };
+}
+function validateurllist(options, key) {
+  const urls = options[key];
+  if (!Array.isArray(urls) || urls.length === 0 || !urls.every((url) => ishttpsurl(url))) return { allowed: false, reason: `A reviewed non-empty list of HTTPS urls is required in options as ${key}.` };
+  return { allowed: true };
+}
+function validateratelimit(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed ratelimit with a window and a ceiling is required in options." };
+  const limit = value;
+  if (limit.domain !== void 0 && !isnonempty(limit.domain)) return { allowed: false, reason: "The reviewed ratelimit domain must be a non-empty string." };
+  if (typeof limit.window !== "number" || !Number.isFinite(limit.window) || limit.window <= 0) return { allowed: false, reason: "The reviewed ratelimit window must be a positive number of milliseconds with no code ceiling." };
+  if (typeof limit.ceiling !== "number" || !Number.isInteger(limit.ceiling) || limit.ceiling < 1) return { allowed: false, reason: "The reviewed ratelimit ceiling must be a positive integer with no code ceiling." };
+  return { allowed: true };
+}
+function validatetabquery(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed tabquery with at least one matcher is required in options." };
+  const query = value;
+  const hasmatcher = query.url !== void 0 || query.title !== void 0 || query.id !== void 0 || query.pattern !== void 0;
+  if (!hasmatcher) return { allowed: false, reason: "The reviewed tabquery needs a url, title, id or pattern matcher." };
+  if (query.url !== void 0 && !isnonempty(query.url)) return { allowed: false, reason: "The reviewed tabquery url matcher must be a non-empty string." };
+  if (query.title !== void 0 && !isnonempty(query.title)) return { allowed: false, reason: "The reviewed tabquery title matcher must be a non-empty string." };
+  if (query.pattern !== void 0 && !isnonempty(query.pattern)) return { allowed: false, reason: "The reviewed tabquery pattern matcher must be a non-empty string." };
+  if (query.id !== void 0 && (typeof query.id !== "number" || !Number.isInteger(query.id) || query.id < 0)) return { allowed: false, reason: "The reviewed tabquery id matcher must be a non-negative integer tab id." };
+  return { allowed: true };
+}
+function validategroupcolor(value) {
+  return typeof value === "string" && groupcolors.includes(value);
+}
+function validateidlist(options, key) {
+  const ids = options[key];
+  return Array.isArray(ids) && ids.length > 0 && ids.every((id) => typeof id === "number" && Number.isInteger(id) && id >= 0);
+}
+function validatetabsgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "querytabs" || kind === "closepattern") {
+    const querycheck = validatetabquery(options.tabquery);
+    if (!querycheck.allowed) return querycheck;
+    if (kind === "closepattern" && options.reviewed !== true) return { allowed: false, reason: "The close pattern needs the explicit reviewed flag before any tab closes." };
+  }
+  if (kind === "duplicatetab" || kind === "pintab" || kind === "mutetab" || kind === "movetab" || kind === "movetabwindow" || kind === "badgetab" || kind === "attachmeta") {
+    if (!isnumericid(step.value)) return { allowed: false, reason: "A numeric browser tab id is required." };
+  }
+  if (kind === "focuswindow" || kind === "maximizewindow" || kind === "minimizewindow" || kind === "restorewindow") {
+    if (!isnumericid(step.value)) return { allowed: false, reason: "A numeric browser window id is required." };
+  }
+  if (kind === "pintab" && typeof options.pinned !== "boolean") return { allowed: false, reason: "A reviewed pinned flag is required in options." };
+  if (kind === "mutetab" && typeof options.muted !== "boolean") return { allowed: false, reason: "A reviewed muted flag is required in options." };
+  if (kind === "movetab") {
+    if (typeof options.index !== "number" || !Number.isInteger(options.index) || options.index < 0) return { allowed: false, reason: "A reviewed non-negative target index is required in options." };
+  }
+  if (kind === "movetabwindow") {
+    if (typeof options.windowid !== "number" || !Number.isInteger(options.windowid) || options.windowid < 0) return { allowed: false, reason: "A reviewed target window id is required in options." };
+  }
+  if (kind === "grouptabs") {
+    const group = options.group;
+    if (!group || typeof group !== "object" || Array.isArray(group)) return { allowed: false, reason: "A reviewed group with a name is required in options." };
+    const spec = group;
+    if (!isnonempty(spec.name)) return { allowed: false, reason: "The reviewed group needs a non-empty name." };
+    if (!validategroupcolor(spec.color)) return { allowed: false, reason: "The reviewed group color must be a Chromium tab group color." };
+    if (!validateidlist(spec, "tabids")) return { allowed: false, reason: "The reviewed group needs a non-empty list of member tab ids." };
+  }
+  if (kind === "colorgroup") {
+    if (!isnonempty(options.name)) return { allowed: false, reason: "A reviewed group name is required in options." };
+    if (!validategroupcolor(options.color)) return { allowed: false, reason: "The reviewed group color must be a Chromium tab group color." };
+  }
+  if (kind === "collapsegroup") {
+    if (!isnonempty(options.name)) return { allowed: false, reason: "A reviewed group name is required in options." };
+    if (typeof options.collapsed !== "boolean") return { allowed: false, reason: "A reviewed collapsed flag is required in options." };
+  }
+  if (kind === "discardtab" || kind === "reloadtabs") {
+    if (!isnumericid(step.value) && !validateidlist(options, "tabs")) return { allowed: false, reason: "A numeric tab id or a reviewed list of tab ids is required." };
+  }
+  if (kind === "zoomin" || kind === "zoomout") {
+    if (options.step !== void 0 && (typeof options.step !== "number" || !Number.isFinite(options.step) || options.step <= 0)) return { allowed: false, reason: "The reviewed zoom step must be a positive number with no code ceiling." };
+    if (step.value !== void 0 && step.value !== "" && !isnumericid(step.value)) return { allowed: false, reason: "The reviewed zoom target must be a numeric tab id." };
+  }
+  if (kind === "switchtab") {
+    if (options.direction !== "next" && options.direction !== "previous") return { allowed: false, reason: "A reviewed switch direction of next or previous is required in options." };
+  }
+  if (kind === "restorewindow") {
+    const bounds = options.bounds;
+    if (bounds !== void 0) {
+      if (!bounds || typeof bounds !== "object" || Array.isArray(bounds)) return { allowed: false, reason: "The reviewed window bounds must be an object." };
+      const shape = bounds;
+      for (const field of ["left", "top", "width", "height"]) {
+        if (typeof shape[field] !== "number" || !Number.isFinite(shape[field])) return { allowed: false, reason: "The reviewed window bounds need numeric left, top, width and height." };
+      }
+    }
+  }
+  if (kind === "scratchwindow") {
+    if (step.value !== void 0 && step.value !== "" && !ishttpsurl(step.value)) return { allowed: false, reason: "The reviewed scratch window url must use HTTPS." };
+  }
+  if (kind === "incognitowindow" && !ishttpsurl(step.value)) return { allowed: false, reason: "A reviewed HTTPS url is required to open an incognito window." };
+  if (kind === "restoretab" && step.value !== void 0 && step.value !== "" && !ishttpsurl(step.value)) return { allowed: false, reason: "The reviewed restore url must use HTTPS." };
+  if (kind === "savelayout" || kind === "restorelayout") {
+    if (!isnonempty(options.name)) return { allowed: false, reason: "A reviewed layout name is required in options." };
+  }
+  if (kind === "badgetab") {
+    if (!isnonempty(options.label)) return { allowed: false, reason: "A reviewed badge label is required in options." };
+    if (options.taskid !== void 0 && !isnonempty(options.taskid)) return { allowed: false, reason: "The reviewed badge task id must be a non-empty string." };
+  }
+  if (kind === "attachmeta") {
+    const labels = options.labels;
+    const taskrefs = options.taskrefs;
+    const haslabels = Array.isArray(labels) && labels.length > 0 && labels.every((label) => isnonempty(label));
+    const hastaskrefs = Array.isArray(taskrefs) && taskrefs.length > 0 && taskrefs.every((ref) => isnonempty(ref));
+    if (!haslabels && !hastaskrefs) return { allowed: false, reason: "Reviewed labels or task refs are required in options to attach metadata." };
+    if (options.provenance !== void 0 && !isnonempty(options.provenance)) return { allowed: false, reason: "The reviewed provenance must be a non-empty string." };
+  }
+  if (kind === "reopenrun" && !isnonempty(options.run)) return { allowed: false, reason: "A reviewed run id is required in options to reopen its tabs." };
+  return { allowed: true };
+}
 function validatestep(step, origin) {
   if (!allowedactions.has(step.kind)) return { allowed: false, reason: "Unsupported action kind." };
   if (!step.summary.trim()) return { allowed: false, reason: "A human-readable action summary is required." };
@@ -491,6 +901,84 @@ function validatestep(step, origin) {
     const versions = options.versions;
     if (!Array.isArray(versions) || versions.length !== 2 || !versions.every((version) => typeof version === "number" && Number.isInteger(version) && version >= 1)) return { allowed: false, reason: "Two reviewed observation version numbers are required in options." };
   }
+  if (step.kind === "openlink" || step.kind === "openprivate" || step.kind === "deeplink") {
+    const targetcheck = validatenavtarget(options.navtarget, step.kind);
+    if (!targetcheck.allowed) return targetcheck;
+    if (step.kind === "deeplink") {
+      const app = options.app;
+      if (!isnonempty(app)) return { allowed: false, reason: "A reviewed deep link app pattern is required in options." };
+      const params = options.params;
+      if (params !== void 0 && (!params || typeof params !== "object" || Array.isArray(params) || !Object.values(params).every((item) => typeof item === "string"))) return { allowed: false, reason: "The reviewed deep link params must be an object of string values." };
+    }
+  }
+  if (step.kind === "waitload" && !nonnegativeoption(options, "timeout")) return { allowed: false, reason: "The waitload timeout must be zero or a positive number of milliseconds." };
+  if (step.kind === "waiturl" || step.kind === "spawait") {
+    if (step.kind === "waiturl") {
+      const patterncheck = validateurlpattern(options.urlpattern);
+      if (!patterncheck.allowed) return patterncheck;
+    }
+    if (!nonnegativeoption(options, "timeout")) return { allowed: false, reason: "The wait timeout must be zero or a positive number of milliseconds." };
+    if (!nonnegativeoption(options, "poll")) return { allowed: false, reason: "The wait poll interval must be zero or a positive number of milliseconds." };
+  }
+  if (step.kind === "followlink") {
+    if (options.fragment !== void 0 && typeof options.fragment !== "boolean") return { allowed: false, reason: "The reviewed followlink fragment flag must be a boolean." };
+  }
+  if (step.kind === "spanav") {
+    if (options.routepattern !== void 0) {
+      const routecheck = validateurlpattern(options.routepattern);
+      if (!routecheck.allowed) return routecheck;
+    }
+    if (!nonnegativeoption(options, "timeout")) return { allowed: false, reason: "The spanav route timeout must be zero or a positive number of milliseconds." };
+  }
+  if (step.kind === "rewritequery") {
+    const set = options.set;
+    const remove = options.remove;
+    if (set === void 0 && remove === void 0) return { allowed: false, reason: "Reviewed query parameters to set or remove are required in options." };
+    if (set !== void 0 && (!set || typeof set !== "object" || Array.isArray(set) || !Object.values(set).every((item) => typeof item === "string"))) return { allowed: false, reason: "The reviewed query parameters to set must be an object of string values." };
+    if (remove !== void 0 && (!Array.isArray(remove) || !remove.every((item) => isnonempty(item)))) return { allowed: false, reason: "The reviewed query parameters to remove must be a list of non-empty names." };
+  }
+  if (step.kind === "navlist") {
+    const listcheck = validateurllist(options, "urls");
+    if (!listcheck.allowed) return listcheck;
+  }
+  if (step.kind === "navprofile") {
+    const profilecheck = validatewaitprofile(options.waitprofile);
+    if (!profilecheck.allowed) return profilecheck;
+  }
+  if (step.kind === "handleauth" && !ishttpsurl(step.value)) return { allowed: false, reason: "A reviewed HTTPS origin or url is required as the auth target." };
+  if (step.kind === "printpdf" && options.name !== void 0 && !isnonempty(options.name)) return { allowed: false, reason: "The reviewed artifact name must be a non-empty string." };
+  if (step.kind === "prefetch") {
+    const listcheck = validateurllist(options, "urls");
+    if (!listcheck.allowed) return listcheck;
+  }
+  if (step.kind === "preconnect") {
+    const origins = options.origins;
+    if (!Array.isArray(origins) || origins.length === 0 || !origins.every((originurl) => ishttpsurl(originurl))) return { allowed: false, reason: "A reviewed non-empty list of HTTPS origins is required in options." };
+  }
+  if (step.kind === "reopentab" && step.value !== void 0 && !ishttpsurl(step.value)) return { allowed: false, reason: "The reviewed reopen url must use HTTPS." };
+  if (step.kind === "navrate") {
+    const limitcheck = validateratelimit(options.ratelimit);
+    if (!limitcheck.allowed) return limitcheck;
+  }
+  if (step.kind === "checksafe" && !ishttpsurl(step.value)) return { allowed: false, reason: "A reviewed HTTPS url is required for the safety check." };
+  if (step.kind === "batchopen") {
+    const listcheck = validateurllist(options, "urls");
+    if (!listcheck.allowed) return listcheck;
+  }
+  if (istabscommandkind(step.kind)) {
+    const tabscheck = validatetabsgrammar(step, options);
+    if (!tabscheck.allowed) return tabscheck;
+  }
+  if (step.kind === "tabcreate") {
+    if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
+    if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
+  }
+  if (step.kind === "windowcreate") {
+    for (const field of ["left", "top", "width", "height"]) {
+      if (options[field] !== void 0 && (typeof options[field] !== "number" || !Number.isFinite(options[field]))) return { allowed: false, reason: `The reviewed window ${field} must be a number.` };
+    }
+    if (options.state !== void 0 && !["normal", "maximized", "minimized", "fullscreen"].includes(options.state)) return { allowed: false, reason: "The reviewed window state must be normal, maximized, minimized or fullscreen." };
+  }
   return { allowed: true };
 }
 function sessiongate(input) {
@@ -508,6 +996,37 @@ function canexecute(input) {
   if (input.plan.expiresat <= now) return { allowed: false, reason: "The approved plan has expired." };
   if ((input.step.kind === "pierceshadow" || input.step.kind === "enterframe") && !origingranted(input.session, input.origin)) return { allowed: false, reason: "The shadow or frame step is outside the session origin grants." };
   if (input.step.kind === "readjson" && !origingranted(input.session, input.origin)) return { allowed: false, reason: "The json state read is outside the session origin grants." };
+  if (input.step.kind === "navlist") {
+    let options = {};
+    try {
+      options = parseoptions(input.step);
+    } catch {
+      options = {};
+    }
+    for (const url of Array.isArray(options.urls) ? options.urls : []) {
+      if (typeof url !== "string") continue;
+      const navigation = navigationgranted(input.session, url);
+      if (!navigation.allowed) return navigation;
+    }
+  }
+  if (islayoutkind(input.step.kind) && !layoutmutationgranted(input.session, now).allowed) return { allowed: false, reason: "Group and layout mutations stay inside the active session." };
+  if (input.step.kind === "openlink" || input.step.kind === "openprivate" || input.step.kind === "batchopen" || input.step.kind === "prefetch" || input.step.kind === "deeplink" || input.step.kind === "reopentab") {
+    let options = {};
+    try {
+      options = parseoptions(input.step);
+    } catch {
+      options = {};
+    }
+    const grammar = validatestep(input.step, input.origin);
+    if (!grammar.allowed) return grammar;
+    const grants = input.session?.grants ?? [input.session?.origin ?? input.origin];
+    const targets = input.step.kind === "batchopen" || input.step.kind === "prefetch" ? Array.isArray(options.urls) ? options.urls : [] : input.step.kind === "reopentab" ? [input.step.value] : [options.navtarget?.url];
+    for (const target of targets) {
+      if (typeof target !== "string" || !target) continue;
+      const verified = originverified(target, grants, input.verdicts ?? []);
+      if (!verified.allowed) return verified;
+    }
+  }
   return validatestep(input.step, input.origin);
 }
 function canpreview(input) {
@@ -558,9 +1077,23 @@ function recordwatchcompletion(progress, planid, stepid, startedat, lifetime, no
   if (!watchclosed(startedat, lifetime, now)) return base;
   return recordstep(base, planid, stepid, now);
 }
+function recordnaventry(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.ok, summary: `Navigation list entry ${entry.index + 1} of ${entry.url} ${entry.ok ? "completed" : "failed"}.`, details: { naventry: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function assigntasktab(progress, planid, tabid2, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  if ((base.tasktabs ?? []).includes(tabid2)) return { ...base, updatedat: now };
+  return { ...base, tasktabs: [...base.tasktabs ?? [], tabid2], updatedat: now };
+}
+function tasktabs(progress, planid) {
+  if (!progress || progress.planid !== planid) return [];
+  return progress.tasktabs ?? [];
+}
 
 // version.ts
-var packageversion = "1.1.34";
+var packageversion = "1.1.36";
 
 // types.ts
 var protocolversion = packageversion;
@@ -640,6 +1173,18 @@ function signalsreport(input) {
     ...signals && signals.banner !== void 0 ? { banner: signals.banner } : {}
   };
 }
+function navstateresponse(input) {
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, navstate: input.navstate });
+}
+function trailreport(input) {
+  return { version: protocolversion, ...input.sessionid ? { sessionid: input.sessionid } : {}, trail: input.trail };
+}
+function safetyresponse(input) {
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, verdicts: input.verdicts });
+}
+function layoutreport(input) {
+  return { version: protocolversion, layouts: input.layouts };
+}
 
 // extension/browsertabs.ts
 var browserkinds = /* @__PURE__ */ new Set(["tablist", "tabcreate", "tabactivate", "tabclose", "tabreload", "tabsnapshot", "windowlist", "windowcreate", "windowclose", "zoomset", "windowresize", "downloadfile"]);
@@ -675,8 +1220,9 @@ async function runbrowseraction(step, sessiontabid, windowid) {
       return { ok: true, summary: `Listed ${tabs.length} open tab${tabs.length === 1 ? "" : "s"}.`, details: { tabs: tabs.map((tab) => ({ id: tab.id ?? 0, index: tab.index, title: tab.title ?? "", url: tab.url ?? "", active: tab.active, pinned: tab.pinned, audible: tab.audible ?? false })) } };
     }
     case "tabcreate": {
-      const created = await chrome.tabs.create({ url: step.value, active: options.active !== false, pinned: options.pinned === true });
-      return { ok: true, summary: `Opened a new tab for ${step.value}.`, details: { tabid: created?.id ?? 0 } };
+      const targetwindow = typeof options.window === "number" && Number.isFinite(options.window) ? options.window : void 0;
+      const created = await chrome.tabs.create({ url: step.value, active: options.active !== false && options.background !== true, pinned: options.pinned === true, ...targetwindow !== void 0 ? { windowId: targetwindow } : {} });
+      return { ok: true, summary: `Opened a new tab for ${step.value}${options.background === true ? " in the background without activating it" : ""}.`, details: { tabid: created?.id ?? 0, ...targetwindow !== void 0 ? { windowid: targetwindow } : {}, ...options.background === true ? { background: true } : {} } };
     }
     case "tabactivate": {
       await chrome.tabs.update(tabid(step), { active: true });
@@ -699,8 +1245,11 @@ async function runbrowseraction(step, sessiontabid, windowid) {
       return { ok: true, summary: `Listed ${windows.length} open window${windows.length === 1 ? "" : "s"}.`, details: { windows: windows.map((item) => ({ id: item.id ?? 0, type: item.type, state: item.state ?? "", focused: item.focused })) } };
     }
     case "windowcreate": {
-      const created = await chrome.windows.create({ url: step.value ?? "about:blank", ...typeof options.width === "number" ? { width: options.width } : {}, ...typeof options.height === "number" ? { height: options.height } : {} });
-      return { ok: true, summary: `Opened a new window for ${step.value}.`, details: { windowid: created?.id ?? 0 } };
+      const bounds = ["left", "top", "width", "height"].filter((field) => typeof options[field] === "number");
+      const geometry = Object.fromEntries(bounds.map((field) => [field, options[field]]));
+      const state = typeof options.state === "string" && ["normal", "maximized", "minimized", "fullscreen"].includes(options.state) ? options.state : void 0;
+      const created = await chrome.windows.create({ url: step.value ?? "about:blank", ...Object.keys(geometry).length > 0 ? geometry : {}, ...state !== void 0 ? { state } : {} });
+      return { ok: true, summary: `Opened a new window for ${step.value}.`, details: { windowid: created?.id ?? 0, ...Object.keys(geometry).length > 0 ? { bounds: geometry } : {}, ...state !== void 0 ? { state } : {} } };
     }
     case "windowclose": {
       await chrome.windows.remove(tabid(step));
@@ -724,6 +1273,125 @@ async function runbrowseraction(step, sessiontabid, windowid) {
   }
 }
 
+// extension/tabscommand.ts
+function parsetabquery(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const value = options.tabquery;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const query = value;
+  return {
+    ...typeof query.url === "string" && query.url ? { url: query.url } : {},
+    ...typeof query.title === "string" && query.title ? { title: query.title } : {},
+    ...typeof query.id === "number" && Number.isInteger(query.id) && query.id >= 0 ? { id: query.id } : {},
+    ...typeof query.pattern === "string" && query.pattern ? { pattern: query.pattern } : {}
+  };
+}
+function tabpatternmatches(pattern, url) {
+  const source = pattern.split("**").map((part) => part.split("*").map((piece) => piece.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")).join(".*");
+  return new RegExp(`^${source}$`).test(url);
+}
+function querymatches(query, tabs) {
+  return tabs.filter((tab) => {
+    if (query.id !== void 0 && tab.tabid !== query.id) return false;
+    if (query.url !== void 0 && tab.url !== query.url) return false;
+    if (query.title !== void 0 && !tab.title.toLowerCase().includes(query.title.toLowerCase())) return false;
+    if (query.pattern !== void 0 && !tabpatternmatches(query.pattern, tab.url)) return false;
+    return true;
+  });
+}
+function normalizedtaburl(url) {
+  let normalized = url;
+  const hash = normalized.indexOf("#");
+  if (hash >= 0) normalized = normalized.slice(0, hash);
+  while (normalized.length > 1 && normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+  return normalized;
+}
+function clonetabs(tabs) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const tab of tabs) {
+    if (!tab.url) continue;
+    const key = normalizedtaburl(tab.url);
+    groups.set(key, [...groups.get(key) ?? [], tab.tabid]);
+  }
+  return [...groups.entries()].filter(([, tabids]) => tabids.length > 1).map(([url, tabids]) => ({ url, tabids }));
+}
+function searchtabmatches(tabs, text2) {
+  const needle = text2.trim().toLowerCase();
+  if (!needle) return [];
+  return tabs.filter((tab) => tab.title.toLowerCase().includes(needle) || tab.url.toLowerCase().includes(needle));
+}
+function audiotabs(tabs) {
+  return tabs.filter((tab) => tab.audible || tab.muted && tab.audible);
+}
+function discardcandidates(tabs) {
+  return tabs.filter((tab) => !tab.active && !tab.pinned && !tab.discarded && tab.url.length > 0);
+}
+function buildlayout(name, tabs, windows, groups, scratchwindowids, at) {
+  return {
+    name,
+    tabs: tabs.map((tab) => ({ url: tab.url, title: tab.title, pinned: tab.pinned, index: tab.index, windowid: tab.windowid })),
+    groups: groups.map((group) => ({ name: group.name, color: group.color, tabids: group.tabids.filter((tabid2) => tabs.some((tab) => tab.tabid === tabid2)), collapsed: group.collapsed })),
+    windows: windows.map((item) => ({ windowid: item.windowid, state: { bounds: { left: item.left, top: item.top, width: item.width, height: item.height }, maximized: item.state === "maximized", profile: item.incognito ? "incognito" : scratchwindowids.includes(item.windowid) ? "scratch" : "normal" } })),
+    savedat: at
+  };
+}
+function layoutrestoreplan(layout, openurls) {
+  const open = new Set(openurls.map((url) => normalizedtaburl(url)));
+  return layout.tabs.map((tab) => tab.url).filter((url) => url.length > 0 && !open.has(normalizedtaburl(url)));
+}
+function regroupaftermoves(groups, tabs, at) {
+  const order = new Map(tabs.map((tab) => [tab.tabid, tab.index]));
+  return groups.map((group) => {
+    const members = group.tabids.filter((tabid2) => order.has(tabid2));
+    if (members.length === 0) return group;
+    const ordered = [...members].sort((left, right) => (order.get(left) ?? 0) - (order.get(right) ?? 0));
+    return ordered.length === group.tabids.length && ordered.every((tabid2, index) => tabid2 === group.tabids[index]) ? group : { ...group, tabids: ordered, savedat: at };
+  });
+}
+function tasktabsinwindow(tabs, windowid, tasktabids) {
+  const tasks = new Set(tasktabids);
+  return tabs.filter((tab) => tab.windowid === windowid && tasks.has(tab.tabid)).length;
+}
+function closeselection(query, tabs, sessiontabid) {
+  const matches = querymatches(query, tabs);
+  return {
+    targets: matches.filter((tab) => tab.tabid !== sessiontabid),
+    refused: matches.filter((tab) => tab.tabid === sessiontabid)
+  };
+}
+function zoomstep(current, direction, step) {
+  const next = direction === "in" ? current + step : current - step;
+  return next > 0 ? Number(next.toFixed(4)) : current;
+}
+function switchtarget(tabs, direction, currentindex) {
+  if (tabs.length === 0) return void 0;
+  const offset = direction === "next" ? 1 : -1;
+  return (currentindex + offset + tabs.length) % tabs.length;
+}
+function watchtabdispatch(events, watchid, filters) {
+  const allowed = filters.length > 0 ? new Set(filters) : void 0;
+  return events.filter((event) => event.watchid === watchid && (allowed === void 0 || allowed.has(event.event)));
+}
+function badgefromprogress(completed, total) {
+  if (total <= 0) return { label: "idle", done: false };
+  if (completed >= total) return { label: "done", done: true };
+  return { label: `${completed}/${total}`, done: false };
+}
+function tasktabgauge(used, ceiling) {
+  return { used, ceiling, over: ceiling !== void 0 && used > ceiling };
+}
+function windowprofilegrants(profile) {
+  return profile !== "incognito";
+}
+function trackedtasktabs(progress, planid) {
+  return tasktabs(progress, planid);
+}
+
 // extension/pagedialogs.ts
 function parsedialogpolicy(step) {
   let options = {};
@@ -857,12 +1525,332 @@ function heldkeys(holds, tabid2) {
   return holds.filter((hold) => hold.releasedat === void 0 && (tabid2 === void 0 || hold.tabid === void 0 || hold.tabid === tabid2));
 }
 
+// extension/pagenav.ts
+function parsenavtarget(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const value = options.navtarget;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const target = value;
+  if (typeof target.url !== "string" || !target.url) return null;
+  const container = target.container === "current" || target.container === "window" || target.container === "private" ? target.container : "tab";
+  return {
+    url: target.url,
+    container,
+    ...target.position === "end" ? { position: "end" } : { position: "adjacent" },
+    private: container === "private" || target.private === true
+  };
+}
+function resolvecontainer(target, windows) {
+  if (target.container === "current") return { kind: "current", incognito: false, position: target.position ?? "adjacent" };
+  if (target.container === "private" || target.private) return { kind: "private", incognito: true, position: target.position ?? "adjacent" };
+  if (target.container === "window") {
+    const focused = windows.find((item) => item.focused);
+    return { kind: "window", incognito: false, ...focused ? { windowid: focused.id } : {}, position: target.position ?? "adjacent" };
+  }
+  const normal = windows.find((item) => !item.incognito && item.focused) ?? windows.find((item) => !item.incognito);
+  return { kind: "tab", incognito: false, ...normal ? { windowid: normal.id } : {}, position: target.position ?? "adjacent" };
+}
+function parsewaitprofile(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const value = options.waitprofile;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const profile = value;
+  const signals = Array.isArray(profile.signals) ? profile.signals.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  if (signals.length === 0) return null;
+  const overrides = [];
+  if (Array.isArray(profile.overrides)) {
+    for (const item of profile.overrides) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+      const override = item;
+      if (typeof override.origin !== "string" || !override.origin) continue;
+      const overridesignals = Array.isArray(override.signals) ? override.signals.filter((entry) => typeof entry === "string" && entry.trim().length > 0) : void 0;
+      overrides.push({
+        origin: override.origin,
+        ...overridesignals && overridesignals.length > 0 ? { signals: overridesignals } : {},
+        ...typeof override.idle === "number" && Number.isFinite(override.idle) && override.idle >= 0 ? { idle: override.idle } : {},
+        ...typeof override.timeout === "number" && Number.isFinite(override.timeout) && override.timeout >= 0 ? { timeout: override.timeout } : {}
+      });
+    }
+  }
+  return {
+    signals,
+    ...typeof profile.idle === "number" && Number.isFinite(profile.idle) && profile.idle >= 0 ? { idle: profile.idle } : {},
+    ...typeof profile.timeout === "number" && Number.isFinite(profile.timeout) && profile.timeout >= 0 ? { timeout: profile.timeout } : {},
+    ...overrides.length > 0 ? { overrides } : {}
+  };
+}
+function profilefororigin(profile, origin) {
+  let signals = [...profile.signals];
+  let idle = profile.idle ?? 0;
+  let timeout = profile.timeout ?? 0;
+  for (const override of profile.overrides ?? []) {
+    if (!override.origin || new URL(override.origin).origin !== origin) continue;
+    if (override.signals && override.signals.length > 0) signals = [...override.signals];
+    if (override.idle !== void 0) idle = override.idle;
+    if (override.timeout !== void 0) timeout = override.timeout;
+  }
+  return { signals, idle, timeout };
+}
+function deeplinkurl(app, params) {
+  const value = (name) => {
+    const item = params[name];
+    return typeof item === "string" && item.trim() ? item.trim() : void 0;
+  };
+  switch (app.trim().toLowerCase()) {
+    case "github": {
+      const owner = value("owner");
+      const repo = value("repo");
+      if (!owner || !repo) return null;
+      const path = value("path");
+      return `https://github.com/${owner}/${repo}${path ? `/${path.replace(/^\/+/, "")}` : ""}`;
+    }
+    case "youtube": {
+      const id = value("id");
+      if (id) return `https://www.youtube.com/watch?v=${encodeURIComponent(id)}`;
+      const search = value("search");
+      if (search) return `https://www.youtube.com/results?search_query=${encodeURIComponent(search)}`;
+      return null;
+    }
+    case "maps": {
+      const query = value("query");
+      if (!query) return null;
+      return `https://www.google.com/maps/search/${encodeURIComponent(query)}`;
+    }
+    case "wikipedia": {
+      const title = value("title");
+      if (!title) return null;
+      const language = value("language") ?? "en";
+      return `https://${language}.wikipedia.org/wiki/${encodeURIComponent(title.replace(/\s+/g, "_"))}`;
+    }
+    case "amazon": {
+      const search = value("search");
+      if (!search) return null;
+      return `https://www.amazon.com/s?k=${encodeURIComponent(search)}`;
+    }
+    case "x": {
+      const user = value("user");
+      if (!user) return null;
+      return `https://x.com/${user.replace(/^@/, "")}`;
+    }
+    default:
+      return null;
+  }
+}
+function pickrecenttab(recenttabs, openurls) {
+  return recenttabs.find((tab) => !openurls.includes(tab.url)) ?? null;
+}
+
+// extension/pagenet.ts
+function buildredirectchain(events) {
+  const hops = [];
+  let startedat = 0;
+  let endedat = 0;
+  let open = false;
+  for (const event of events) {
+    if (event.event === "beforenavigate") {
+      hops.length = 0;
+      startedat = event.timestamp;
+      endedat = event.timestamp;
+      open = true;
+      hops.push({ url: event.url, status: event.status ?? 0, at: event.timestamp });
+      continue;
+    }
+    if (!open) continue;
+    endedat = event.timestamp;
+    if (event.event === "urlchange" || event.redirect || event.event === "committed" && hops[hops.length - 1]?.url !== event.url) {
+      if (hops[hops.length - 1]?.url === event.url && typeof event.status === "number") hops[hops.length - 1] = { url: event.url, status: event.status, at: event.timestamp };
+      else hops.push({ url: event.url, status: event.status ?? 0, at: event.timestamp });
+      continue;
+    }
+    if (event.event === "committed" && typeof event.status === "number" && hops[hops.length - 1]) {
+      hops[hops.length - 1] = { url: event.url, status: event.status, at: event.timestamp };
+      continue;
+    }
+    if (event.event === "completed" || event.event === "error") {
+      if (event.event === "completed" && hops[hops.length - 1] && hops[hops.length - 1]?.url !== event.url) hops.push({ url: event.url, status: event.status ?? 200, at: event.timestamp });
+      if (event.event === "completed" && typeof event.status === "number" && hops[hops.length - 1]) hops[hops.length - 1] = { url: event.url, status: event.status, at: event.timestamp };
+      open = false;
+    }
+  }
+  return { hops, startedat, endedat: endedat || startedat };
+}
+function finalurl(chain) {
+  return chain.hops[chain.hops.length - 1]?.url ?? "";
+}
+function classifynavchange(previousurl, currenturl, status) {
+  if (previousurl === currenturl) return status === "loading" ? "reload" : "none";
+  try {
+    if (new URL(previousurl).origin !== new URL(currenturl).origin) return "load";
+  } catch {
+    return "load";
+  }
+  return status === "loading" ? "load" : "route";
+}
+function detecthttpstate(input) {
+  const reasons = [];
+  let httperror = false;
+  let certificate = false;
+  const errors = input.errors ?? [];
+  const statuses = input.statuses ?? [];
+  for (const error of errors) {
+    if (/CERT|SSL|TLS|privacy bad|your connection is not private/i.test(error)) {
+      certificate = true;
+      httperror = true;
+      reasons.push(`certificate interstitial: ${error}`);
+      continue;
+    }
+    if (/ERR_NAME_NOT_RESOLVED|ERR_CONNECTION|ERR_TIMED_OUT|ERR_INTERNET_DISCONNECTED|ERR_ADDRESS_UNREACHABLE|ERR_NETWORK/i.test(error)) {
+      httperror = true;
+      reasons.push(`network error: ${error}`);
+      continue;
+    }
+    httperror = true;
+    reasons.push(`navigation error: ${error}`);
+  }
+  for (const status of statuses) {
+    if (status >= 400 && status < 600) {
+      httperror = true;
+      reasons.push(`http status ${status}`);
+    }
+  }
+  if (input.offline) reasons.push("browser reports offline");
+  return { httperror, offline: input.offline, certificate, reasons };
+}
+function interstitialpolicy(state) {
+  if (state.certificate) return { interstitial: true, bypass: false, guidance: "A certificate interstitial was detected; Devthink reports it for review and never bypasses it." };
+  if (state.httperror) return { interstitial: true, bypass: false, guidance: "An http error state was detected and is reported for review." };
+  return { interstitial: false, bypass: false, guidance: "No interstitial was detected." };
+}
+function parseratelimit(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const value = options.ratelimit;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const limit = value;
+  const window2 = typeof limit.window === "number" && Number.isFinite(limit.window) && limit.window > 0 ? limit.window : 0;
+  const ceiling = typeof limit.ceiling === "number" && Number.isInteger(limit.ceiling) && limit.ceiling >= 1 ? limit.ceiling : 0;
+  if (window2 <= 0 || ceiling < 1) return null;
+  const domain = typeof limit.domain === "string" && limit.domain.trim() ? limit.domain.trim() : "";
+  return { domain, window: window2, ceiling };
+}
+function domainof(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return "";
+  }
+}
+function ratewindow(state, limit, now) {
+  if (state && state.domain === limit.domain && state.limit.window === limit.window && state.limit.ceiling === limit.ceiling && now < state.openedat + limit.window) return state;
+  return { domain: limit.domain, limit, openedat: now, count: 0 };
+}
+function rateallows(state, now) {
+  const elapsed = now - state.openedat;
+  const remaining = Math.max(0, state.limit.ceiling - state.count);
+  const retryafter = Math.max(0, state.limit.window - elapsed);
+  return { allowed: remaining > 0, remaining, retryafter };
+}
+function recordratehit(state, now) {
+  return { ...state, count: state.count + 1, ...state.count + 1 === 1 ? { openedat: now } : {} };
+}
+function checksafe(url) {
+  const reasons = [];
+  let safe = true;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { url, safe: false, reasons: ["the url does not parse"], at: 0 };
+  }
+  if (parsed.protocol !== "https:") {
+    safe = false;
+    reasons.push("the url must use HTTPS");
+  }
+  if (parsed.username || parsed.password) {
+    safe = false;
+    reasons.push("the url carries embedded credentials");
+  }
+  const host = parsed.hostname.toLowerCase();
+  const privatelist = ["localhost", "127.0.0.1", "0.0.0.0", "::1", "[::1]"];
+  if (privatelist.includes(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host) || /^169\.254\./.test(host)) {
+    safe = false;
+    reasons.push(`the host ${host} is a private network target`);
+  }
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || /^\[?[0-9a-f:]+\]?$/i.test(host)) {
+    safe = false;
+    reasons.push(`the host ${host} is a raw address without a domain`);
+  }
+  return { url, safe, reasons, at: 0 };
+}
+function curatelinks(urls, verifier) {
+  return urls.map((url) => {
+    const verdict = verifier(url);
+    return { url, verdict: verdict.safe ? "safe" : "unsafe", reasons: verdict.reasons };
+  });
+}
+function batchopenset(links) {
+  const open = [];
+  const refused = [];
+  for (const link of links) {
+    if (link.verdict === "safe") open.push(link.url);
+    else refused.push({ url: link.url, reasons: link.reasons });
+  }
+  return { open, refused };
+}
+function prefetchcandidates(urls, grants) {
+  const allowed = [];
+  const refused = [];
+  for (const url of urls) {
+    let origin = "";
+    try {
+      origin = new URL(url).origin;
+    } catch {
+      refused.push(url);
+      continue;
+    }
+    if (grants.includes(origin)) allowed.push(url);
+    else refused.push(url);
+  }
+  return { allowed, refused };
+}
+function preconnectorigins(origins) {
+  return [...new Set(origins.map((origin) => origin.trim()).filter(Boolean))];
+}
+function authfor(auths, url) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return void 0;
+  }
+  return auths.find((record2) => record2.origin === origin);
+}
+
 // extension/background.ts
 var sessionduration = 15 * 60 * 1e3;
 var freshcheckkinds = /* @__PURE__ */ new Set(["focus", "inspect", "click", "type", "scroll", "select", "hover"]);
 var pointerkinds = /* @__PURE__ */ new Set(["movepointer", "clickpoint", "shiftclick", "clicktext", "clickaria", "clickname", "pierceshadow"]);
 var watchstepkinds = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus"]);
 var observationstepkinds = /* @__PURE__ */ new Set(["a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "readselection", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector"]);
+var navigationstepkinds = /* @__PURE__ */ new Set(["openlink", "openprivate", "reloadcache", "stopnav", "waitload", "waiturl", "followlink", "spanav", "spawait", "rewritequery", "setfragment", "navlist", "navprofile", "detecthttp", "readredirects", "readfinalurl", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "trailaudit", "pausenav", "navintent", "navrate", "openclipboard", "checksafe", "batchopen"]);
+var pausenavkinds = /* @__PURE__ */ new Set(["openlink", "openprivate", "followlink", "spanav", "navlist", "openclipboard", "batchopen", "prefetch", "preconnect", "deeplink", "reopentab"]);
+var ratecheckedkinds = /* @__PURE__ */ new Set(["openlink", "openprivate", "followlink", "spanav", "navlist", "openclipboard", "batchopen", "deeplink", "reopentab"]);
+var evidencepoll = 100;
+var evidencesettle = 5e3;
 var chromestorage = {
   async get(key) {
     return (await chrome.storage.local.get(key))[key];
@@ -1026,12 +2014,26 @@ function browserauditkind(step) {
 }
 function stepauditkind(step, ok) {
   if (isbrowserkind(step.kind)) return browserauditkind(step);
+  if (istabscommandkind(step.kind)) {
+    if (step.kind === "grouptabs" || step.kind === "colorgroup" || step.kind === "collapsegroup") return "group";
+    if (step.kind === "savelayout" || step.kind === "restorelayout" || step.kind === "snapshotsession" || step.kind === "reopenrun") return "layout";
+    if (step.kind === "discardtab") return "discard";
+    if (step.kind === "badgetab") return "badge";
+    if (step.kind === "watchtab") return "watch";
+    if (step.kind === "maximizewindow" || step.kind === "minimizewindow" || step.kind === "restorewindow" || step.kind === "focuswindow" || step.kind === "scratchwindow" || step.kind === "incognitowindow") return "window";
+    return "tab";
+  }
   if (step.kind === "dismissdialog") return "dialog";
   if (step.kind === "keyhold" || step.kind === "keyrelease") return "hold";
   if (step.kind === "retryaction") return "retry";
   if (pointerkinds.has(step.kind)) return "pointer";
   if (watchstepkinds.has(step.kind)) return "watch";
   if (step.kind === "diffsnapshots") return "diff";
+  if (step.kind === "readredirects" || step.kind === "readfinalurl" || step.kind === "detecthttp") return "redirect";
+  if (step.kind === "handleauth") return "auth";
+  if (step.kind === "prefetch" || step.kind === "preconnect") return "prefetch";
+  if (step.kind === "navrate") return "rate";
+  if (navigationstepkinds.has(step.kind)) return "navigation";
   if (observationstepkinds.has(step.kind)) return "observation";
   return ok ? "action" : "error";
 }
@@ -1254,22 +2256,877 @@ async function recordevidence(step, output, session, plan, origin) {
   }
   await refreshsignals(step, output);
 }
+var navbuffers = /* @__PURE__ */ new Map();
+var lastknownurls = /* @__PURE__ */ new Map();
+async function tracktabupdate(tabid2, changeinfo) {
+  const now = Date.now();
+  const url = typeof changeinfo.url === "string" ? changeinfo.url : void 0;
+  const status = changeinfo.status;
+  if (typeof changeinfo.title === "string" && changeinfo.title) {
+    lastknowntitles.set(tabid2, changeinfo.title);
+    await recordtabwatchevent("title", tabid2, changeinfo.title);
+  }
+  const previous = lastknownurls.get(tabid2);
+  if (status === "loading" && url) {
+    navbuffers.set(tabid2, [{ event: "beforenavigate", url, timestamp: now }]);
+    lastknownurls.set(tabid2, url);
+    return;
+  }
+  const buffer = navbuffers.get(tabid2) ?? [];
+  if (url) {
+    const kind = classifynavchange(previous ?? url, url, status);
+    buffer.push({ event: kind === "route" ? "urlchange" : "committed", url, timestamp: now, redirect: kind === "route" });
+    if (kind === "route" && previous) {
+      const session = await memory.getsession();
+      if (session && !session.stoppedat && session.tabid === tabid2) {
+        await memory.addtrailentry(session.id, { url, title: "", at: now });
+      }
+    }
+    lastknownurls.set(tabid2, url);
+  }
+  if (status === "complete") buffer.push({ event: "completed", url: lastknownurls.get(tabid2) ?? "", timestamp: now, status: 200 });
+  navbuffers.set(tabid2, buffer);
+}
+chrome.tabs.onUpdated.addListener((tabid2, changeinfo) => {
+  void tracktabupdate(tabid2, changeinfo);
+});
+chrome.tabs.onActivated.addListener((activeinfo) => {
+  void recordtabwatchevent("activated", activeinfo.tabId);
+});
+chrome.tabs.onRemoved.addListener((tabid2) => {
+  const url = lastknownurls.get(tabid2);
+  const title = lastknowntitles.get(tabid2) ?? "";
+  const windowid = 0;
+  if (url) {
+    void memory.addrecenttab({ url, tabid: tabid2, closedat: Date.now() });
+    void memory.addclosedtab({ url, title, tabid: tabid2, windowid, closedat: Date.now() });
+  }
+  void recordtabwatchevent("closed", tabid2, url);
+  lastknownurls.delete(tabid2);
+  lastknowntitles.delete(tabid2);
+  navbuffers.delete(tabid2);
+});
+async function recordnavigation(step, session, tabid2) {
+  const started = Date.now();
+  let tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  while (tab && tab.status !== "complete" && Date.now() - started < evidencesettle) {
+    await new Promise((resolve) => setTimeout(resolve, evidencepoll));
+    tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+  }
+  const url = tab?.url ?? lastknownurls.get(tabid2) ?? "";
+  const title = tab?.title ?? "";
+  const chain = buildredirectchain(navbuffers.get(tabid2) ?? []);
+  const record2 = {
+    stepid: step.id,
+    ...session ? { sessionid: session.id } : {},
+    origin: session?.origin ?? (url ? new URL(url).origin : ""),
+    finalurl: finalurl(chain) || url,
+    chain,
+    at: Date.now()
+  };
+  await memory.addnavrecord(record2);
+  await memory.setnavstate(tabid2, record2);
+  if (session && url) await memory.addtrailentry(session.id, { url, title, stepid: step.id, at: Date.now() });
+  return record2;
+}
+function injectallowedorigins(step, session) {
+  const allowedorigins = session?.grants ?? (session ? [session.origin] : []);
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  return { ...step, options: JSON.stringify({ ...options, allowedorigins }) };
+}
+async function enforceratelimit(url, stepid, sessionid) {
+  const domain = domainof(url);
+  if (!domain) return;
+  const states = await memory.getratestates();
+  const stored = states.find((item) => item.domain === domain);
+  if (!stored) return;
+  const live = ratewindow(stored, stored.limit, Date.now());
+  const decision = rateallows(live, Date.now());
+  if (!decision.allowed) {
+    await audit("rate", `The navigation rate limit of ${live.limit.ceiling} per ${live.limit.window} milliseconds for ${domain} was exceeded; the navigation was refused.`, { ...sessionid ? { sessionid } : {}, stepid });
+    throw new Error(`The navigation rate limit for ${domain} has been reached; retry after ${Math.ceil(decision.retryafter / 1e3)} seconds.`);
+  }
+  await memory.setratestate(recordratehit(live, Date.now()));
+  await audit("rate", `Navigation to ${url} counted against the reviewed rate limit of ${live.limit.ceiling} per ${live.limit.window} milliseconds for ${domain}; ${decision.remaining - 1} remaining.`, { ...sessionid ? { sessionid } : {}, stepid });
+}
+async function refusenavpause(step) {
+  if (!pausenavkinds.has(step.kind)) return;
+  const control = await memory.getnavcontrol();
+  if (control?.pausedat) throw new Error(control.reason ? `Navigation is paused: ${control.reason}` : "Navigation is paused while a consent prompt is open; resume navigation first.");
+}
+async function opencontainer(step, session, url, container, position) {
+  const windows = await chrome.windows.getAll().catch(() => []);
+  const plan = resolvecontainer({ url, container, position, private: container === "private" }, windows.map((item) => ({ id: item.id ?? 0, incognito: item.incognito ?? false, focused: item.focused ?? false })));
+  const extra = { ...session ? { sessionid: session.id } : {}, stepid: step.id };
+  if (plan.kind === "current" && session) {
+    const tabid2 = session.tabid;
+    await chrome.tabs.update(tabid2, { url });
+    const record2 = await recordnavigation(step, session, tabid2);
+    await audit("navigation", `Navigated the task tab to ${url}.`, extra);
+    return { ok: true, summary: `Navigated the task tab to ${url}.`, details: { container: plan.kind, url, finalurl: record2.finalurl, hops: record2.chain.hops.length } };
+  }
+  if (plan.kind === "private" || plan.kind === "window") {
+    const created2 = await chrome.windows.create({ url, incognito: plan.incognito });
+    await audit("navigation", `Opened ${plan.kind === "private" ? "a private window" : "a new window"} for ${url}${plan.kind === "private" ? " separated from normal windows" : ""}.`, extra);
+    return { ok: true, summary: `Opened ${plan.kind === "private" ? "a private window" : "a new window"} for ${url}.`, details: { container: plan.kind, url, windowid: created2?.id ?? 0, incognito: plan.incognito } };
+  }
+  const created = await chrome.tabs.create({ url, ...plan.windowid !== void 0 ? { windowId: plan.windowid } : {}, active: true });
+  await audit("navigation", `Opened a new tab for ${url} without leaving the current page.`, extra);
+  return { ok: true, summary: `Opened a new tab for ${url}.`, details: { container: "tab", url, tabid: created?.id ?? 0, position: plan.position } };
+}
+async function verifyopenurl(url, session) {
+  const grants = session?.grants ?? (session ? [session.origin] : []);
+  const verified = originverified(url, grants, await memory.getsafeties());
+  if (!verified.allowed) throw new Error(verified.reason);
+}
+async function executeopenlink(step, session) {
+  const target = parsenavtarget(step);
+  if (!target) throw new Error("A reviewed navtarget is required.");
+  await refusenavpause(step);
+  await enforceratelimit(target.url, step.id, session?.id);
+  await verifyopenurl(target.url, session);
+  return opencontainer(step, session, target.url, target.container, target.position ?? "adjacent");
+}
+async function executedeeplink(step, session) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const params = {};
+  if (options.params && typeof options.params === "object" && !Array.isArray(options.params)) {
+    for (const [name, value] of Object.entries(options.params)) if (typeof value === "string") params[name] = value;
+  }
+  const url = deeplinkurl(typeof options.app === "string" ? options.app : "", params);
+  if (!url) throw new Error("The reviewed deep link pattern is not a known web app.");
+  await refusenavpause(step);
+  await enforceratelimit(url, step.id, session?.id);
+  await verifyopenurl(url, session);
+  const target = parsenavtarget(step);
+  const container = target?.container === "window" ? "window" : target?.container === "private" ? "private" : target?.container === "current" ? "current" : "tab";
+  const output = await opencontainer(step, session, url, container, target?.position ?? "adjacent");
+  return { ...output, details: { ...output.details ?? {}, app: options.app, deeplink: url } };
+}
+async function executereopentab(step, session) {
+  await refusenavpause(step);
+  let url = step.value;
+  if (!url) {
+    const tabs = await chrome.tabs.query({}).catch(() => []);
+    const openurls = tabs.map((tab) => tab.url ?? "").filter(Boolean);
+    const recent = pickrecenttab(await memory.getrecenttabs(), openurls);
+    if (!recent) throw new Error("No recently closed tab is available to reopen.");
+    url = recent.url;
+  }
+  await enforceratelimit(url, step.id, session?.id);
+  await verifyopenurl(url, session);
+  const created = await chrome.tabs.create({ url, active: true });
+  await audit("navigation", `Reopened the recently closed tab ${url}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Reopened ${url} in a new tab.`, details: { url, tabid: created?.id ?? 0 } };
+}
+async function waitforcomplete(tabid2) {
+  const started = Date.now();
+  for (; ; ) {
+    const tab = await chrome.tabs.get(tabid2).catch(() => void 0);
+    if (!tab) return false;
+    if (tab.status === "complete") return true;
+    if (Date.now() - started >= evidencesettle) return false;
+    await new Promise((resolve) => setTimeout(resolve, evidencepoll));
+  }
+}
+async function recordnaventryoutcome(step, plan, entry) {
+  const base = await memory.getprogress();
+  await memory.setprogress(recordnaventry(base, plan.id, step.id, entry, Date.now()));
+}
+async function executenavlist(step, session, plan, tabid2) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const urls = Array.isArray(options.urls) ? options.urls.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  if (urls.length === 0) throw new Error("A reviewed list of navigation urls is required.");
+  await refusenavpause(step);
+  let completed = 0;
+  let failed = "";
+  for (let index = 0; index < urls.length; index += 1) {
+    const url = urls[index];
+    const entrygate = navigationgranted(session, url);
+    if (!entrygate.allowed) {
+      failed = entrygate.reason ?? "The navigation list entry was refused.";
+      await recordnaventryoutcome(step, plan, { index, url, ok: false });
+      break;
+    }
+    try {
+      await enforceratelimit(url, step.id, session?.id);
+      await refusenavpause(step);
+      await chrome.tabs.update(tabid2, { url });
+      await waitforcomplete(tabid2);
+      await recordnavigation(step, session, tabid2);
+      completed += 1;
+      await recordnaventryoutcome(step, plan, { index, url, ok: true });
+    } catch (error) {
+      failed = error instanceof Error ? error.message : String(error);
+      await recordnaventryoutcome(step, plan, { index, url, ok: false });
+      break;
+    }
+  }
+  const remaining = urls.length - completed;
+  const ok = failed === "" && completed === urls.length;
+  return {
+    ok,
+    summary: ok ? `Navigated the reviewed list of ${urls.length} url${urls.length === 1 ? "" : "s"} sequentially.` : `The navigation list stopped after ${completed} of ${urls.length} entries: ${failed}`,
+    details: { completed, remaining, urls }
+  };
+}
+async function executenavprofile(step, session, origin) {
+  const profile = parsewaitprofile(step);
+  if (!profile) throw new Error("A reviewed waitprofile is required.");
+  const record2 = { origin, profile, at: Date.now() };
+  await memory.setwaitprofile(record2);
+  const effective = profilefororigin(profile, origin);
+  await audit("navigation", `Wait profile applied for ${origin} with signals ${effective.signals.join(", ")}${effective.idle > 0 ? `, idle ${effective.idle}ms` : ""}${effective.timeout > 0 ? ` and timeout ${effective.timeout}ms` : ""}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Applied the reviewed wait profile for ${origin} during navigation.`, details: { origin, signals: effective.signals, idle: effective.idle, timeout: effective.timeout, overrides: (profile.overrides ?? []).map((override) => override.origin) } };
+}
+async function executedetecthttp(session, tabid2) {
+  const records = await memory.getnavrecords();
+  const buffer = navbuffers.get(tabid2) ?? [];
+  const errors = buffer.filter((event) => event.error !== void 0).map((event) => event.error);
+  const statuses = (records[0]?.chain.hops ?? []).map((hop) => hop.status).filter((status) => status > 0);
+  const state = detecthttpstate({ offline: !navigator.onLine, errors, statuses });
+  const policy = interstitialpolicy(state);
+  return {
+    ok: true,
+    summary: state.httperror || state.offline ? `Detected ${state.reasons.length} navigation problem${state.reasons.length === 1 ? "" : "s"}: ${state.reasons.join("; ")}.` : "No http error, offline state or certificate interstitial was detected.",
+    details: { httperror: state.httperror, offline: state.offline, certificate: state.certificate, reasons: state.reasons, interstitial: policy.interstitial, bypass: policy.bypass, guidance: policy.guidance }
+  };
+}
+async function executereadredirects(session) {
+  const record2 = (await memory.getnavrecords()).find((item) => !session || item.sessionid === session.id);
+  if (!record2) return { ok: false, summary: "No navigation has been recorded yet.", details: { chain: { hops: [], startedat: 0, endedat: 0 } } };
+  return { ok: true, summary: `The latest navigation travelled ${Math.max(0, record2.chain.hops.length - 1)} redirect${record2.chain.hops.length - 1 === 1 ? "" : "s"} to ${record2.finalurl}.`, details: { chain: record2.chain, finalurl: record2.finalurl, duration: record2.chain.endedat - record2.chain.startedat } };
+}
+async function executereadfinalurl(session) {
+  const record2 = (await memory.getnavrecords()).find((item) => !session || item.sessionid === session.id);
+  if (!record2) return { ok: false, summary: "No navigation has been recorded yet.", details: { finalurl: "" } };
+  return { ok: true, summary: `The final url after redirects is ${record2.finalurl}.`, details: { finalurl: record2.finalurl, hops: record2.chain.hops } };
+}
+async function executehandleauth(step, session) {
+  const auths = await memory.getauths();
+  const record2 = authfor(auths, step.value ?? "");
+  if (!record2) throw new Error(`No reviewed basic auth credentials are stored for ${step.value ?? ""}; store them from the side panel first.`);
+  await audit("auth", `Basic auth credentials for ${record2.origin} reviewed as ${record2.username} were armed for the auth prompt; the password stays out of every step detail.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Armed the reviewed basic auth credentials of ${record2.username} for ${record2.origin}.`, details: { origin: record2.origin, username: record2.username, reviewedat: record2.reviewedat, armed: true } };
+}
+async function executeprintpdf(step, session, plan, tabid2, origin) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const output = await dispatchpagestep(step, tabid2, origin, plan);
+  const name = typeof options.name === "string" && options.name ? options.name : `${step.id}.pdf`;
+  const artifact = { id: randomid(), kind: "printpdf", name, stepid: step.id, at: Date.now() };
+  await memory.addartifact(artifact);
+  await audit("navigation", `Printed the page to pdf through the browser print pipeline and routed the artifact ${name} into the task artifact store.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: output?.ok ?? false, summary: output?.summary ?? "The print pipeline returned no result.", details: { ...output?.details ?? {}, artifact } };
+}
+async function executeprefetch(step, session, plan, tabid2, origin) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const urls = Array.isArray(options.urls) ? options.urls.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  const grants = session?.grants ?? (session ? [session.origin] : []);
+  const verdict = prefetchcandidates(urls, grants);
+  if (verdict.allowed.length === 0) throw new Error("No prefetch candidate is covered by the session grants.");
+  await refusenavpause(step);
+  const derived = { ...step, options: JSON.stringify({ ...options, urls: verdict.allowed }) };
+  const output = await dispatchpagestep(derived, tabid2, origin, plan);
+  await memory.setnavqueues({ prefetch: verdict.allowed.length, batchopen: (await memory.getnavqueues())?.batchopen ?? 0, updatedat: Date.now() });
+  await refreshbadge();
+  await audit("prefetch", `Prefetched ${verdict.allowed.length} predicted next page${verdict.allowed.length === 1 ? "" : "s"} verified against the session grants${verdict.refused.length > 0 ? ` and refused ${verdict.refused.length} candidate${verdict.refused.length === 1 ? "" : "s"} outside the grants` : ""}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: Boolean(output?.ok), summary: output?.summary ?? "The prefetch step returned no result.", details: { ...output?.details ?? {}, allowed: verdict.allowed, refused: verdict.refused } };
+}
+async function executepreconnect(step, session, plan, tabid2, origin) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const origins = preconnectorigins(Array.isArray(options.origins) ? options.origins.filter((item) => typeof item === "string") : []);
+  await refusenavpause(step);
+  const output = await dispatchpagestep({ ...step, options: JSON.stringify({ ...options, origins }) }, tabid2, origin, plan);
+  await audit("prefetch", `Preconnected to ${origins.length} expected origin${origins.length === 1 ? "" : "s"}: ${origins.join(", ")}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: Boolean(output?.ok), summary: output?.summary ?? "The preconnect step returned no result.", details: { ...output?.details ?? {}, origins } };
+}
+async function executeopenclipboard(step, session) {
+  await refusenavpause(step);
+  const text2 = await navigator.clipboard.readText();
+  let url = "";
+  try {
+    url = new URL(text2.trim()).toString();
+  } catch {
+    throw new Error("The clipboard does not hold a valid url.");
+  }
+  if (!url.startsWith("https://")) throw new Error("The clipboard url must use HTTPS.");
+  await enforceratelimit(url, step.id, session?.id);
+  await verifyopenurl(url, session);
+  const output = await opencontainer(step, session, url, "tab", "adjacent");
+  await audit("navigation", `Opened the clipboard url ${url} on the explicit consent of the reviewed step.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ...output, details: { ...output.details ?? {}, url } };
+}
+async function executechecksafe(step, session, planid) {
+  const verdict = { ...checksafe(step.value ?? ""), at: Date.now() };
+  await memory.addsafety(verdict);
+  await audit("navigation", `Safety check of ${verdict.url} returned ${verdict.safe ? "safe" : "unsafe"}${verdict.reasons.length > 0 ? `: ${verdict.reasons.join("; ")}` : ""}.`, { ...session ? { sessionid: session.id } : {}, ...planid ? { planid } : {}, stepid: step.id });
+  return { ok: true, summary: verdict.safe ? `The url ${verdict.url} passed every safety check.` : `The url ${verdict.url} is unsafe: ${verdict.reasons.join("; ")}.`, details: { verdict } };
+}
+async function executebatchopen(step, session) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const urls = Array.isArray(options.urls) ? options.urls.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  const links = curatelinks(urls, (url) => ({ ...checksafe(url), at: Date.now() }));
+  const curated = { id: randomid(), links, at: Date.now() };
+  await memory.addcurated(curated);
+  const set = batchopenset(links);
+  if (set.refused.length > 0) {
+    await memory.setnavqueues({ prefetch: (await memory.getnavqueues())?.prefetch ?? 0, batchopen: set.refused.length, updatedat: Date.now() });
+    await refreshbadge();
+    await audit("navigation", `Batch open refused for ${set.refused.length} unsafe url${set.refused.length === 1 ? "" : "s"}; the curated list waits for review.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+    return { ok: false, summary: `The batch was refused because ${set.refused.length} of ${links.length} urls are unsafe; review the curated list before opening.`, details: { curated, refused: set.refused } };
+  }
+  await refusenavpause(step);
+  const opened = [];
+  for (const url of set.open) {
+    await enforceratelimit(url, step.id, session?.id);
+    const created = await chrome.tabs.create({ url, active: opened.length === 0 });
+    opened.push(created?.id ?? 0);
+    if (session) await memory.addtrailentry(session.id, { url, title: "", stepid: step.id, at: Date.now() });
+  }
+  await memory.addcurated({ ...curated, reviewedat: Date.now() });
+  await memory.setnavqueues({ prefetch: (await memory.getnavqueues())?.prefetch ?? 0, batchopen: 0, updatedat: Date.now() });
+  await refreshbadge();
+  await audit("navigation", `Batch opened ${set.open.length} curated url${set.open.length === 1 ? "" : "s"} after per url safety checks.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Opened ${set.open.length} curated url${set.open.length === 1 ? "" : "s"} after per url safety checks.`, details: { curated, tabids: opened } };
+}
+async function executepausenav(step, session) {
+  const control = await memory.getnavcontrol();
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  if (control?.pausedat) {
+    await memory.setnavcontrol({ updatedat: Date.now() });
+    await audit("resume", `Navigation resumed after ${Date.now() - control.pausedat} milliseconds of pause.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+    return { ok: true, summary: "Navigation resumed; reviewed navigation steps can run again.", details: { paused: false } };
+  }
+  const reason = typeof options.reason === "string" && options.reason ? options.reason : "a consent prompt is open";
+  await memory.setnavcontrol({ pausedat: Date.now(), reason, updatedat: Date.now() });
+  await audit("pause", `Navigation paused while ${reason}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Navigation paused while ${reason}.`, details: { paused: true, reason } };
+}
+async function executenavintent(step, session, origin) {
+  const record2 = { id: randomid(), intent: step.value ?? "", origin, ...session ? { sessionid: session.id } : {}, stepid: step.id, at: Date.now() };
+  await memory.addnavintent(record2);
+  await audit("navigation", `Navigation intent "${record2.intent}" recorded for ${origin}.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Recorded the navigation intent "${record2.intent}".`, details: { intent: record2.intent, origin, at: record2.at } };
+}
+async function executenavrate(step, session, origin) {
+  const limit = parseratelimit(step);
+  if (!limit) throw new Error("A reviewed ratelimit is required.");
+  if (!limit.domain) limit.domain = domainof(origin) || origin;
+  const states = await memory.getratestates();
+  const stored = states.find((item) => item.domain === limit.domain);
+  const live = ratewindow(stored, limit, Date.now());
+  const decision = rateallows(live, Date.now());
+  await memory.setratestate(live);
+  await audit("rate", `Navigation rate limit of ${limit.ceiling} per ${limit.window} milliseconds applied for ${limit.domain}; ${decision.remaining} navigation${decision.remaining === 1 ? "" : "s"} remaining in the window.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Applied the reviewed navigation rate limit for ${limit.domain}.`, details: { domain: limit.domain, window: limit.window, ceiling: limit.ceiling, count: live.count, remaining: decision.remaining, retryafter: decision.retryafter } };
+}
+async function executetrailaudit(session) {
+  if (!session) throw new Error("No active browser session exists.");
+  const trail = await memory.gettrail(session.id);
+  return { ok: true, summary: `The navigation trail of the session holds ${trail.length} visited url${trail.length === 1 ? "" : "s"}.`, details: { trail } };
+}
+async function executenavigationkind(step, session, plan, tabid2, origin) {
+  switch (step.kind) {
+    case "openlink":
+      return executeopenlink(step, session);
+    case "openprivate":
+      return executeopenlink(step, session);
+    case "deeplink":
+      return executedeeplink(step, session);
+    case "reopentab":
+      return executereopentab(step, session);
+    case "reloadcache": {
+      await refusenavpause(step);
+      await chrome.tabs.reload(tabid2, { bypassCache: true });
+      const record2 = await recordnavigation(step, session, tabid2);
+      await audit("navigation", `Reloaded the page bypassing the cache.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+      return { ok: true, summary: "Reloaded the page bypassing the cache.", details: { bypasscache: true, finalurl: record2.finalurl } };
+    }
+    case "navlist":
+      return executenavlist(step, session, plan, tabid2);
+    case "navprofile":
+      return executenavprofile(step, session, origin);
+    case "detecthttp":
+      return executedetecthttp(session, tabid2);
+    case "readredirects":
+      return executereadredirects(session);
+    case "readfinalurl":
+      return executereadfinalurl(session);
+    case "handleauth":
+      return executehandleauth(step, session);
+    case "printpdf":
+      return executeprintpdf(step, session, plan, tabid2, origin);
+    case "prefetch":
+      return executeprefetch(step, session, plan, tabid2, origin);
+    case "preconnect":
+      return executepreconnect(step, session, plan, tabid2, origin);
+    case "checksafe":
+      return executechecksafe(step, session, plan.id);
+    case "batchopen":
+      return executebatchopen(step, session);
+    case "pausenav":
+      return executepausenav(step, session);
+    case "navintent":
+      return executenavintent(step, session, origin);
+    case "navrate":
+      return executenavrate(step, session, origin);
+    case "trailaudit":
+      return executetrailaudit(session);
+    case "openclipboard":
+      return executeopenclipboard(step, session);
+    default: {
+      await refusenavpause(step);
+      if (ratecheckedkinds.has(step.kind)) await enforceratelimit(origin, step.id, session?.id);
+      const derived = injectallowedorigins(step, session);
+      const output = await dispatchpagestep(derived, tabid2, origin, plan);
+      if (step.kind === "followlink" || step.kind === "spanav") {
+        const record2 = await recordnavigation(step, session, tabid2);
+        return { ...output ?? { ok: false, summary: "The navigation step returned no result." }, details: { ...(output ?? {}).details ?? {}, finalurl: record2.finalurl, hops: record2.chain.hops.length } };
+      }
+      return output ?? { ok: false, summary: "The navigation step returned no result." };
+    }
+  }
+}
+async function livetabs() {
+  const tabs = await chrome.tabs.query({}).catch(() => []);
+  return tabs.map((tab) => ({
+    tabid: tab.id ?? 0,
+    url: tab.url ?? "",
+    title: tab.title ?? "",
+    index: tab.index,
+    windowid: tab.windowId ?? 0,
+    active: tab.active,
+    pinned: tab.pinned,
+    audible: tab.audible ?? false,
+    muted: tab.mutedInfo?.muted ?? false,
+    discarded: tab.discarded ?? false
+  }));
+}
+async function livewindows() {
+  const windows = await chrome.windows.getAll().catch(() => []);
+  return windows.map((item) => ({
+    windowid: item.id ?? 0,
+    left: item.left ?? 0,
+    top: item.top ?? 0,
+    width: item.width ?? 0,
+    height: item.height ?? 0,
+    state: item.state === "maximized" || item.state === "minimized" || item.state === "fullscreen" ? item.state : "normal",
+    incognito: item.incognito ?? false,
+    focused: item.focused
+  }));
+}
+var tabwatchbuffers = /* @__PURE__ */ new Map();
+var lastknowntitles = /* @__PURE__ */ new Map();
+async function recordtabwatchevent(event, tabid2, detail) {
+  const now = Date.now();
+  for (const watch of await memory.getwatches()) {
+    if (watch.closedat !== void 0 || watch.kind !== "watchtab") continue;
+    if (watchclosed(watch.startedat, watch.lifetime, now)) continue;
+    if (watch.events.length > 0 && !watch.events.includes(event)) continue;
+    const record2 = { watchid: watch.watchid, event, tabid: tabid2, ...detail !== void 0 ? { detail } : {}, at: now };
+    await memory.addtabwatchevent(record2);
+    tabwatchbuffers.set(watch.watchid, [...tabwatchbuffers.get(watch.watchid) ?? [], record2]);
+  }
+}
+async function buildtabreport(matches) {
+  const [groups, badges, metas] = await Promise.all([memory.gettabgroups(), memory.getbadges(), memory.gettabmetas()]);
+  const metabytab = new Map(metas.map((meta) => [meta.tabid, meta]));
+  const entries = matches.map((tab) => ({
+    tabid: tab.tabid,
+    url: tab.url,
+    title: tab.title,
+    index: tab.index,
+    windowid: tab.windowid,
+    active: tab.active,
+    pinned: tab.pinned,
+    audible: tab.audible,
+    muted: tab.muted,
+    discarded: tab.discarded,
+    ...metabytab.has(tab.tabid) ? { meta: metabytab.get(tab.tabid) } : {}
+  }));
+  return { matches: entries, groups: groups.map((group) => ({ name: group.name, color: group.color, tabids: group.tabids, collapsed: group.collapsed })), badges };
+}
+function commandtabids(step, options) {
+  const listed = Array.isArray(options.tabs) ? options.tabs.filter((item) => typeof item === "number" && Number.isInteger(item) && item >= 0) : [];
+  const single = step.value && /^\d+$/.test(step.value) ? [Number.parseInt(step.value, 10)] : [];
+  return listed.length > 0 ? listed : single;
+}
+async function executetabscommand(step, session, plan, sessiontabid) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
+  const layoutgate = layoutmutationgranted(session, Date.now());
+  if (islayoutkind(step.kind) && !layoutgate.allowed) throw new Error(layoutgate.reason ?? "Group and layout mutations stay inside the active session.");
+  switch (step.kind) {
+    case "querytabs": {
+      const query = parsetabquery(step);
+      if (!query) throw new Error("A reviewed tabquery is required.");
+      const matches = querymatches(query, await livetabs());
+      const report = await buildtabreport(matches);
+      await audit("tab", `Queried the live tab set and matched ${matches.length} tab${matches.length === 1 ? "" : "s"}.`, extra);
+      return { ok: true, summary: `Matched ${matches.length} open tab${matches.length === 1 ? "" : "s"} by the reviewed tabquery.`, details: { report, matches: matches.length } };
+    }
+    case "duplicatetab": {
+      const source = Number.parseInt(step.value ?? "", 10);
+      const created = await chrome.tabs.duplicate(source);
+      await audit("tab", `Duplicated tab ${source} with its history into tab ${created?.id ?? 0}.`, extra);
+      return { ok: true, summary: `Duplicated tab ${source} with its history.`, details: { sourcetab: source, tabid: created?.id ?? 0 } };
+    }
+    case "closepattern": {
+      const query = parsetabquery(step);
+      if (!query) throw new Error("A reviewed tabquery is required.");
+      const tabs = await livetabs();
+      const selection = closeselection(query, tabs, session?.tabid ?? sessiontabid);
+      if (selection.refused.length > 0) throw new Error("The close pattern matches the session tab itself; review the pattern so the session tab survives.");
+      if (selection.targets.length === 0) return { ok: true, summary: "The reviewed close pattern matched no tab outside the session tab.", details: { closed: 0 } };
+      for (const target of selection.targets) await chrome.tabs.remove(target.tabid).catch(() => void 0);
+      await audit("tab", `Closed ${selection.targets.length} tab${selection.targets.length === 1 ? "" : "s"} matching the reviewed close pattern.`, extra);
+      return { ok: true, summary: `Closed ${selection.targets.length} tab${selection.targets.length === 1 ? "" : "s"} matching the reviewed pattern.`, details: { closed: selection.targets.length, urls: selection.targets.map((tab) => tab.url) } };
+    }
+    case "pintab": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      await chrome.tabs.update(target, { pinned: options.pinned === true });
+      await audit("tab", `${options.pinned === true ? "Pinned" : "Unpinned"} tab ${target} by the reviewed flag.`, extra);
+      return { ok: true, summary: `${options.pinned === true ? "Pinned" : "Unpinned"} tab ${target}.`, details: { tabid: target, pinned: options.pinned === true } };
+    }
+    case "mutetab": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      await chrome.tabs.update(target, { muted: options.muted === true });
+      await audit("tab", `${options.muted === true ? "Muted" : "Unmuted"} tab ${target} by the reviewed flag.`, extra);
+      return { ok: true, summary: `${options.muted === true ? "Muted" : "Unmuted"} tab ${target}.`, details: { tabid: target, muted: options.muted === true } };
+    }
+    case "movetab": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      await chrome.tabs.move(target, { index: options.index });
+      const groups = regroupaftermoves(await memory.gettabgroups(), await livetabs(), Date.now());
+      for (const group of groups) await memory.settabgroup(group);
+      await audit("tab", `Moved tab ${target} to index ${options.index} inside its window; group membership is kept.`, extra);
+      return { ok: true, summary: `Moved tab ${target} to index ${options.index}.`, details: { tabid: target, index: options.index } };
+    }
+    case "movetabwindow": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      await chrome.tabs.move(target, { windowId: options.windowid, index: -1 });
+      const groups = regroupaftermoves(await memory.gettabgroups(), await livetabs(), Date.now());
+      for (const group of groups) await memory.settabgroup(group);
+      await audit("tab", `Moved tab ${target} across windows into window ${options.windowid}; group membership is kept.`, extra);
+      return { ok: true, summary: `Moved tab ${target} into window ${options.windowid}.`, details: { tabid: target, windowid: options.windowid } };
+    }
+    case "grouptabs": {
+      const group = options.group;
+      const record2 = { groupid: randomid(), name: String(group.name ?? ""), color: String(group.color ?? "grey"), tabids: Array.isArray(group.tabids) ? group.tabids.filter((item) => typeof item === "number") : [], collapsed: false, savedat: Date.now() };
+      await memory.settabgroup(record2);
+      await audit("group", `Grouped ${record2.tabids.length} tab${record2.tabids.length === 1 ? "" : "s"} under the reviewed name ${record2.name} with color ${record2.color}; membership lives in the Devthink group registry.`, extra);
+      return { ok: true, summary: `Grouped ${record2.tabids.length} tab${record2.tabids.length === 1 ? "" : "s"} under ${record2.name}.`, details: { group: record2 } };
+    }
+    case "colorgroup": {
+      const groups = await memory.gettabgroups();
+      const target = groups.find((group) => group.name === options.name);
+      if (!target) throw new Error(`No tab group named ${options.name} is stored yet.`);
+      const updated = { ...target, color: String(options.color), savedat: Date.now() };
+      await memory.settabgroup(updated);
+      await audit("group", `Set the color of tab group ${updated.name} to ${updated.color}.`, extra);
+      return { ok: true, summary: `Set the color of group ${updated.name} to ${updated.color}.`, details: { group: updated } };
+    }
+    case "collapsegroup": {
+      const groups = await memory.gettabgroups();
+      const target = groups.find((group) => group.name === options.name);
+      if (!target) throw new Error(`No tab group named ${options.name} is stored yet.`);
+      const updated = { ...target, collapsed: options.collapsed === true, savedat: Date.now() };
+      await memory.settabgroup(updated);
+      await audit("group", `${updated.collapsed ? "Collapsed" : "Expanded"} tab group ${updated.name}.`, extra);
+      return { ok: true, summary: `${updated.collapsed ? "Collapsed" : "Expanded"} group ${updated.name}.`, details: { group: updated } };
+    }
+    case "discardtab": {
+      const ids = commandtabids(step, options);
+      if (ids.length === 0) throw new Error("A numeric tab id or a reviewed list of tab ids is required.");
+      const candidates = discardcandidates(await livetabs()).filter((tab) => ids.includes(tab.tabid));
+      const discarded = [];
+      const urls = [];
+      for (const candidate of candidates) {
+        const result = await chrome.tabs.discard(candidate.tabid).catch(() => void 0);
+        if (result) {
+          discarded.push(candidate.tabid);
+          urls.push({ tabid: candidate.tabid, url: candidate.url });
+        }
+      }
+      await audit("discard", `Discarded ${discarded.length} inactive tab${discarded.length === 1 ? "" : "s"} to save memory; the urls survive for on demand restore.`, extra);
+      return { ok: discarded.length > 0, summary: `Discarded ${discarded.length} inactive tab${discarded.length === 1 ? "" : "s"}; their urls stay available for restore.`, details: { discarded, urls, refused: ids.filter((id) => !discarded.includes(id)) } };
+    }
+    case "reloadtabs": {
+      const ids = commandtabids(step, options);
+      if (ids.length === 0) throw new Error("A numeric tab id or a reviewed list of tab ids is required.");
+      for (const id of ids) await chrome.tabs.reload(id).catch(() => void 0);
+      await audit("tab", `Reloaded ${ids.length} reviewed tab${ids.length === 1 ? "" : "s"}.`, extra);
+      return { ok: true, summary: `Reloaded ${ids.length} tab${ids.length === 1 ? "" : "s"}.`, details: { tabs: ids } };
+    }
+    case "zoomin":
+    case "zoomout": {
+      const target = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : sessiontabid;
+      const current = await chrome.tabs.getZoom(target);
+      const next = zoomstep(current, step.kind === "zoomin" ? "in" : "out", typeof options.step === "number" && options.step > 0 ? options.step : 0.1);
+      await chrome.tabs.setZoom(target, next);
+      await audit("tab", `Zoomed tab ${target} ${step.kind === "zoomin" ? "in" : "out"} from ${current} to ${next} by the reviewed step.`, extra);
+      return { ok: true, summary: `Zoomed tab ${target} ${step.kind === "zoomin" ? "in" : "out"} to ${next}.`, details: { tabid: target, from: current, to: next, step: typeof options.step === "number" ? options.step : 0.1 } };
+    }
+    case "switchtab": {
+      const direction = options.direction === "previous" ? "previous" : "next";
+      const focusedwindow = (await livewindows()).find((item) => item.focused)?.windowid ?? 0;
+      const windowtabs = (await livetabs()).filter((tab) => tab.windowid === focusedwindow);
+      const active = windowtabs.find((tab) => tab.active);
+      const target = switchtarget(windowtabs, direction, active?.index ?? 0);
+      const totab = windowtabs.find((tab) => tab.index === target);
+      if (!totab) throw new Error("No neighbor tab is available to switch to.");
+      await chrome.tabs.update(totab.tabid, { active: true });
+      await audit("tab", `Switched to the ${direction} tab ${totab.tabid}.`, extra);
+      return { ok: true, summary: `Switched to the ${direction} tab.`, details: { tabid: totab.tabid, direction } };
+    }
+    case "maximizewindow": {
+      await chrome.windows.update(windowid, { state: "maximized" });
+      await audit("window", `Maximized window ${windowid}.`, extra);
+      return { ok: true, summary: `Maximized window ${windowid}.`, details: { windowid, state: "maximized" } };
+    }
+    case "minimizewindow": {
+      await chrome.windows.update(windowid, { state: "minimized" });
+      await audit("window", `Minimized window ${windowid}.`, extra);
+      return { ok: true, summary: `Minimized window ${windowid}.`, details: { windowid, state: "minimized" } };
+    }
+    case "restorewindow": {
+      const bounds = options.bounds;
+      await chrome.windows.update(windowid, { state: "normal", ...bounds && typeof bounds.left === "number" ? { left: bounds.left } : {}, ...bounds && typeof bounds.top === "number" ? { top: bounds.top } : {}, ...bounds && typeof bounds.width === "number" ? { width: bounds.width } : {}, ...bounds && typeof bounds.height === "number" ? { height: bounds.height } : {} });
+      await audit("window", `Restored window ${windowid} to its reviewed bounds.`, extra);
+      return { ok: true, summary: `Restored window ${windowid} to its reviewed bounds.`, details: { windowid, bounds: bounds ?? null } };
+    }
+    case "focuswindow": {
+      await chrome.windows.update(windowid, { focused: true });
+      await audit("window", `Focused window ${windowid}.`, extra);
+      return { ok: true, summary: `Focused window ${windowid}.`, details: { windowid } };
+    }
+    case "scratchwindow": {
+      const url = typeof step.value === "string" && step.value ? step.value : "about:blank";
+      const created = await chrome.windows.create({ url });
+      const window2 = created?.id ?? 0;
+      await memory.setscratchwindows([...await memory.getscratchwindows(), window2]);
+      await audit("window", `Opened a scratch window ${window2} for split work.`, extra);
+      return { ok: true, summary: `Opened a scratch window for split work.`, details: { windowid: window2, url } };
+    }
+    case "incognitowindow": {
+      const created = await chrome.windows.create({ url: step.value ?? "", incognito: true });
+      await audit("window", `Opened an incognito window ${created?.id ?? 0} for ${step.value} on the explicit reviewed request; the window stays separated from the session grant inheritance.`, extra);
+      return { ok: true, summary: `Opened an incognito window for ${step.value} on explicit request.`, details: { windowid: created?.id ?? 0, url: step.value, grantsinherited: windowprofilegrants("incognito") } };
+    }
+    case "restoretab": {
+      const open = (await livetabs()).map((tab) => tab.url).filter(Boolean);
+      let url = step.value && /^https:\/\//.test(step.value) ? step.value : void 0;
+      if (!url) {
+        const closed = (await memory.getclosedtabs()).find((entry) => !open.includes(entry.url));
+        if (!closed) throw new Error("No closed tab is available to restore from the session history.");
+        url = closed.url;
+      }
+      const created = await chrome.tabs.create({ url, active: true });
+      await audit("tab", `Restored the closed tab ${url} from the session history.`, extra);
+      return { ok: true, summary: `Restored ${url} from the closed tab history.`, details: { url, tabid: created?.id ?? 0 } };
+    }
+    case "savelayout": {
+      const name = typeof options.name === "string" ? options.name : "";
+      const [tabs, windows, groups, scratch] = await Promise.all([livetabs(), livewindows(), memory.gettabgroups(), memory.getscratchwindows()]);
+      const layout = buildlayout(name, tabs, windows, groups, scratch, Date.now());
+      await memory.setlayout(layout);
+      await audit("layout", `Saved the tab layout ${name} with ${layout.tabs.length} tab${layout.tabs.length === 1 ? "" : "s"}, ${layout.groups.length} group${layout.groups.length === 1 ? "" : "s"} and ${layout.windows.length} window bound${layout.windows.length === 1 ? "" : "s"}.`, extra);
+      return { ok: true, summary: `Saved the tab layout ${name}.`, details: { layout } };
+    }
+    case "restorelayout": {
+      const name = typeof options.name === "string" ? options.name : "";
+      const layout = await memory.getlayout(name);
+      if (!layout) throw new Error(`No tab layout named ${name} is stored yet.`);
+      const open = (await livetabs()).map((tab) => tab.url).filter(Boolean);
+      const urls = layoutrestoreplan(layout, open);
+      const created = [];
+      for (const url of urls) {
+        const tab = await chrome.tabs.create({ url, active: created.length === 0 });
+        created.push(tab?.id ?? 0);
+      }
+      await audit("layout", `Restored the tab layout ${name}: ${created.length} tab${created.length === 1 ? "" : "s"} reopened, ${layout.tabs.length - created.length} already open.`, extra);
+      return { ok: true, summary: `Restored the tab layout ${name}.`, details: { name, reopened: created.length, alreadyopen: layout.tabs.length - created.length, tabs: created } };
+    }
+    case "findclones": {
+      const clones = clonetabs(await livetabs());
+      await audit("tab", `Detected ${clones.length} duplicate url group${clones.length === 1 ? "" : "s"} across the open tabs.`, extra);
+      return { ok: true, summary: clones.length === 0 ? "No duplicate tab was detected by normalized url comparison." : `Detected ${clones.length} duplicate url group${clones.length === 1 ? "" : "s"}.`, details: { clones } };
+    }
+    case "searchtabs": {
+      const matches = searchtabmatches(await livetabs(), step.value ?? "");
+      await audit("tab", `Searched the open tabs and matched ${matches.length} tab${matches.length === 1 ? "" : "s"} for "${step.value}".`, extra);
+      return { ok: true, summary: `Matched ${matches.length} open tab${matches.length === 1 ? "" : "s"} for "${step.value}".`, details: { matches } };
+    }
+    case "badgetab": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      const badge = { tabid: target, taskid: typeof options.taskid === "string" && options.taskid ? options.taskid : plan.id, label: typeof options.label === "string" ? options.label : "", setat: Date.now() };
+      await memory.setbadge(badge);
+      await refreshbadge();
+      await audit("badge", `Set the task badge of tab ${target} to ${badge.label} for task ${badge.taskid}.`, extra);
+      return { ok: true, summary: `Set the badge of tab ${target} to ${badge.label}.`, details: { badge } };
+    }
+    case "attachmeta": {
+      const target = Number.parseInt(step.value ?? "", 10);
+      const meta = {
+        tabid: target,
+        taskrefs: Array.isArray(options.taskrefs) ? options.taskrefs.filter((item) => typeof item === "string" && item.trim().length > 0) : [],
+        provenance: typeof options.provenance === "string" && options.provenance ? options.provenance : "plan step",
+        labels: Array.isArray(options.labels) ? options.labels.filter((item) => typeof item === "string" && item.trim().length > 0) : [],
+        at: Date.now()
+      };
+      await memory.settabmeta(meta);
+      await memory.setprogress(assigntasktab(await memory.getprogress(), plan.id, target, Date.now()));
+      await audit("tab", `Attached metadata to tab ${target} with ${meta.labels.length} label${meta.labels.length === 1 ? "" : "s"} and ${meta.taskrefs.length} task ref${meta.taskrefs.length === 1 ? "" : "s"}; the tab joins the task progress.`, extra);
+      return { ok: true, summary: `Attached metadata to tab ${target} for task routing.`, details: { meta } };
+    }
+    case "listaudio": {
+      const playing = audiotabs(await livetabs());
+      await audit("tab", `Listed ${playing.length} tab${playing.length === 1 ? "" : "s"} that are playing audio.`, extra);
+      return { ok: true, summary: `${playing.length} tab${playing.length === 1 ? " is" : "s are"} playing audio.`, details: { audio: playing } };
+    }
+    case "reopenrun": {
+      const run = typeof options.run === "string" ? options.run : "";
+      const snapshots = await memory.getsnapshots();
+      const snapshot2 = snapshots.find((item) => item.sessionid === run) ?? snapshots.find((item) => item.id === run);
+      if (!snapshot2) throw new Error(`No stored session snapshot exists for the run ${run}.`);
+      const open = (await livetabs()).map((tab) => tab.url).filter(Boolean);
+      const urls = layoutrestoreplan(snapshot2.layout, open);
+      const created = [];
+      for (const url of urls) {
+        const tab = await chrome.tabs.create({ url, active: created.length === 0 });
+        created.push(tab?.id ?? 0);
+      }
+      await audit("layout", `Reopened ${created.length} tab${created.length === 1 ? "" : "s"} of the previous run ${run}.`, extra);
+      return { ok: true, summary: `Reopened ${created.length} tab${created.length === 1 ? "" : "s"} of the previous run.`, details: { run, reopened: created.length, tabs: created } };
+    }
+    case "snapshotsession": {
+      const [tabs, windows, groups, scratch] = await Promise.all([livetabs(), livewindows(), memory.gettabgroups(), memory.getscratchwindows()]);
+      const layout = buildlayout(`session ${(/* @__PURE__ */ new Date()).toISOString()}`, tabs, windows, groups, scratch, Date.now());
+      const snapshot2 = { id: randomid(), ...session ? { sessionid: session.id } : {}, layout, capturedat: Date.now() };
+      await memory.addsnapshot(snapshot2);
+      await audit("layout", `Captured the full session snapshot with ${layout.tabs.length} tab${layout.tabs.length === 1 ? "" : "s"} and ${layout.windows.length} window${layout.windows.length === 1 ? "" : "s"}.`, extra);
+      return { ok: true, summary: `Captured the session snapshot of ${layout.tabs.length} tabs and ${layout.windows.length} windows.`, details: { snapshot: snapshot2 } };
+    }
+    case "watchtab": {
+      const lifetime = typeof options.lifetime === "number" && Number.isFinite(options.lifetime) && options.lifetime > 0 ? options.lifetime : 0;
+      if (lifetime <= 0) throw new Error("A reviewed watch lifetime window in milliseconds is required in options.");
+      const events = Array.isArray(options.events) ? options.events.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+      const watchid = typeof options.watchid === "string" && options.watchid.trim() ? options.watchid : randomid();
+      const watch = { watchid, kind: "watchtab", stepid: step.id, sessionid: session?.id ?? plan.id, origin: session?.origin ?? plan.origin, scopes: [], events, startedat: Date.now(), lifetime };
+      await memory.addwatch(watch);
+      await audit("watch", `Watchtab registered under id ${watchid} for the reviewed lifetime of ${lifetime} milliseconds${events.length > 0 ? ` over events ${events.join(", ")}` : " over title, activation and closure events"}.`, extra);
+      await new Promise((resolve) => setTimeout(resolve, lifetime));
+      const observed = watchtabdispatch(tabwatchbuffers.get(watchid) ?? [], watchid, events);
+      await memory.closewatch(watchid, Date.now());
+      tabwatchbuffers.delete(watchid);
+      await audit("watch", `Watchtab ${watchid} closed after its reviewed lifetime of ${lifetime} milliseconds with ${observed.length} observed event${observed.length === 1 ? "" : "s"}.`, extra);
+      return { ok: true, summary: `Observed ${observed.length} tab event${observed.length === 1 ? "" : "s"} inside the reviewed lifetime.`, details: { watchid, events: observed } };
+    }
+    default:
+      return { ok: false, summary: "Unsupported tabs and windows command." };
+  }
+}
+async function enforcewindowreview(step, session, plan) {
+  const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
+  const progress = plan ? await memory.getprogress() : void 0;
+  const tasktabids = plan ? trackedtasktabs(progress, plan.id) : [];
+  const count = tasktabsinwindow(await livetabs(), windowid, tasktabids);
+  const gate = windowclosegate(count, stepoptions2(step).reviewed === true);
+  if (!gate.allowed) throw new Error(gate.reason ?? "The window close needs explicit review.");
+  if (session && count > 0) await audit("window", `Window ${windowid} closes while holding ${count} task tab${count === 1 ? "" : "s"} under the explicit reviewed flag.`, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {}, stepid: step.id });
+}
+async function updatetaskbadges(plan, progress) {
+  if (!plan || !progress || progress.planid !== plan.id) return;
+  const state = badgefromprogress(progress.completedsteps.length, plan.steps.length);
+  for (const tabid2 of tasktabs(progress, plan.id)) {
+    await memory.setbadge({ tabid: tabid2, taskid: plan.id, label: state.label, setat: Date.now() });
+  }
+}
+async function togglecontroltab(enabled) {
+  const current = await memory.getcontroltab();
+  if (current && current.tabid) await chrome.tabs.remove(current.tabid).catch(() => void 0);
+  if (!enabled) {
+    const closed = { tabid: 0, enabled: false, updatedat: Date.now() };
+    await memory.setcontroltab(closed);
+    await audit("tab", "The pinned control tab was closed.");
+    return closed;
+  }
+  const created = await chrome.tabs.create({ url: chrome.runtime.getURL("sidepanel.html"), pinned: true, active: false });
+  const state = { tabid: created?.id ?? 0, enabled: true, updatedat: Date.now() };
+  await memory.setcontroltab(state);
+  await audit("tab", `The pinned control tab ${state.tabid} was opened with the live task feed.`);
+  return state;
+}
+async function refreshbadge() {
+  const queues = await memory.getnavqueues();
+  const badges = await memory.getbadges();
+  const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2;
+  await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
+  });
+}
 async function executestep(stepid) {
   const session = await memory.getsession();
   const plan = await memory.getplan();
   const { tab, origin } = await activecontext();
   const step = plan?.steps.find((candidate) => candidate.id === stepid);
   if (!step) throw new Error("Reviewed step was not found.");
-  const gate = canexecute({ session, plan, step, tabid: tab.id, origin });
+  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, verdicts: await memory.getsafeties() });
   if (!gate.allowed) throw new Error(gate.reason);
+  const capability = requiredcapability(step.kind);
+  if (capability) {
+    const granted = await chrome.permissions.contains({ permissions: [capability] });
+    if (!granted) throw new Error(`The ${capability} capability has not been granted; request it from the review panel.`);
+  }
   let output;
   let watchwindow;
-  if (isbrowserkind(step.kind)) {
-    const capability = requiredcapability(step.kind);
-    if (capability) {
-      const granted = await chrome.permissions.contains({ permissions: [capability] });
-      if (!granted) throw new Error(`The ${capability} capability has not been granted; request it from the review panel.`);
-    }
+  if (step.kind === "windowclose") {
+    await enforcewindowreview(step, session, plan);
+  }
+  if (istabscommandkind(step.kind)) {
+    output = await executetabscommand(step, session, plan, tab.id);
+  } else if (isbrowserkind(step.kind)) {
     output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
   } else if (step.kind === "keyhold") {
     output = await executekeyhold(step, session, plan, tab.id, origin);
@@ -1290,6 +3147,8 @@ async function executestep(stepid) {
     watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
   } else if (step.kind === "diffsnapshots") {
     output = await executediffsnapshots(step, session, plan, tab.id, origin);
+  } else if (navigationstepkinds.has(step.kind)) {
+    output = await executenavigationkind(step, session, plan, tab.id, origin);
   } else {
     if (step.target && freshcheckkinds.has(step.kind)) {
       const fresh = await snapshot(tab.id);
@@ -1297,7 +3156,11 @@ async function executestep(stepid) {
     }
     output = await dispatchpagestep(step, tab.id, origin, plan);
   }
+  if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tab.id);
   await recordevidence(step, output, session, plan, origin);
+  if (output?.ok && plan && typeof output.details?.tabid === "number") {
+    await memory.setprogress(assigntasktab(await memory.getprogress(), plan.id, output.details.tabid, Date.now()));
+  }
   const summary = output?.summary ?? "The page action returned no result.";
   const resolved = output?.details?.resolvedtarget;
   if (resolved) {
@@ -1312,6 +3175,8 @@ async function executestep(stepid) {
     const completed = watchwindow ? recordwatchcompletion(base, plan.id, stepid, watchwindow.startedat, watchwindow.lifetime, Date.now()) : recordstep(base, plan.id, stepid, Date.now());
     const tracked = recordoutcome(completed, plan.id, outcome, Date.now());
     await memory.setprogress(tracked);
+    await updatetaskbadges(plan, tracked);
+    await refreshbadge();
     if (iscomplete(tracked, plan) && plan.state === "approved") {
       const done = { ...plan, state: "completed", completedat: Date.now() };
       await memory.setplan(done);
@@ -1390,7 +3255,33 @@ async function handlerequest(message, sender) {
       const a11y = (await memory.geta11ytrees())[0];
       const reader = (await memory.getreaderarticles())[0];
       const signals = await memory.getsignals();
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {} };
+      const trail = session ? await memory.gettrail(session.id) : [];
+      const navrecords = await memory.getnavrecords();
+      const ratestates = await memory.getratestates();
+      const safeties = await memory.getsafeties();
+      const curated = await memory.getcurateds();
+      const waitprofiles = await memory.getwaitprofiles();
+      const auths = (await memory.getauths()).map((record2) => ({ origin: record2.origin, username: record2.username, reviewedat: record2.reviewedat }));
+      const navcontrol = await memory.getnavcontrol();
+      const navqueues = await memory.getnavqueues();
+      const artifacts = await memory.getartifacts();
+      const tabs = await livetabs().catch(() => []);
+      const windows = await livewindows().catch(() => []);
+      const layouts = await memory.getlayouts();
+      const tabgroups = await memory.gettabgroups();
+      const tabmetas = await memory.gettabmetas();
+      const badges = await memory.getbadges();
+      const snapshots = await memory.getsnapshots();
+      const closedtabs = await memory.getclosedtabs();
+      const controltab = await memory.getcontroltab();
+      const tabwatchevents = await memory.gettabwatchevents();
+      const clones = clonetabs(tabs);
+      const taskgauge = tasktabgauge(tabs.filter((tab) => badges.some((badge) => badge.tabid === tab.tabid)).length, tasktabceiling(await memory.getsettings()));
+      const report = await buildtabreport(tabs);
+      const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
+      const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
+      const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -1454,6 +3345,138 @@ async function handlerequest(message, sender) {
       return pausesession();
     case "resumesession":
       return resumesession();
+    case "storeauth": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Basic auth credentials are stored only behind the consent gate of an active session.");
+      const inputauth = message;
+      const origin = new URL(inputauth.origin ?? "").origin;
+      if (!origin.startsWith("https://")) throw new Error("Basic auth credentials need an HTTPS origin.");
+      if (!inputauth.username?.trim() || !inputauth.password) throw new Error("Basic auth credentials need a username and a password.");
+      const record2 = { origin, username: inputauth.username.trim(), password: inputauth.password, reviewedat: Date.now() };
+      await memory.setauth(record2);
+      await audit("auth", `Basic auth credentials for ${origin} stored after explicit review; the password never leaves local storage.`, { sessionid: session.id });
+      return { origin: record2.origin, username: record2.username, reviewedat: record2.reviewedat };
+    }
+    case "checksafe": {
+      const inputurl = message;
+      const verdict = { ...checksafe(inputurl.url ?? ""), at: Date.now() };
+      await memory.addsafety(verdict);
+      const session = await memory.getsession();
+      await audit("navigation", `Safety check of ${verdict.url} returned ${verdict.safe ? "safe" : "unsafe"}${verdict.reasons.length > 0 ? `: ${verdict.reasons.join("; ")}` : ""}.`, { ...session ? { sessionid: session.id } : {} });
+      return verdict;
+    }
+    case "navstate": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a navstate envelope.");
+      const record2 = (await memory.getnavrecords())[0];
+      const session = await memory.getsession();
+      const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
+      const state = { phase: livetab?.status === "loading" ? "loading" : "complete", ...record2 ? { finalurl: record2.finalurl, redirects: record2.chain } : {} };
+      return JSON.parse(navstateresponse({ navstate: state, plan }));
+    }
+    case "safeties": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a safety envelope.");
+      return JSON.parse(safetyresponse({ verdicts: await memory.getsafeties(), plan }));
+    }
+    case "jumptotab": {
+      const inputtab = message;
+      if (typeof inputtab.tabid !== "number") throw new Error("A numeric tab id is required to jump.");
+      await chrome.tabs.update(inputtab.tabid, { active: true }).catch(() => {
+        throw new Error("The tab to jump to is no longer open.");
+      });
+      await audit("tab", `The review panel jumped to tab ${inputtab.tabid}.`);
+      return { tabid: inputtab.tabid };
+    }
+    case "tabsearch": {
+      const inputsearch = message;
+      const granted = await chrome.permissions.contains({ permissions: ["tabs"] });
+      if (!granted) throw new Error("The tabs capability has not been granted; request it from the review panel.");
+      const matches = searchtabmatches(await livetabs(), inputsearch.text ?? "");
+      await audit("tab", `The review panel searched the open tabs for "${inputsearch.text ?? ""}" and matched ${matches.length} tab${matches.length === 1 ? "" : "s"}.`);
+      return { matches };
+    }
+    case "savelayout": {
+      const session = await memory.getsession();
+      const gate = layoutmutationgranted(session, Date.now());
+      if (!gate.allowed) throw new Error(gate.reason);
+      const inputlayout = message;
+      if (!inputlayout.name?.trim()) throw new Error("A layout name is required.");
+      const [tabs, windows, groups, scratch] = await Promise.all([livetabs(), livewindows(), memory.gettabgroups(), memory.getscratchwindows()]);
+      const layout = buildlayout(inputlayout.name.trim(), tabs, windows, groups, scratch, Date.now());
+      await memory.setlayout(layout);
+      await audit("layout", `The review panel saved the tab layout ${layout.name} with ${layout.tabs.length} tabs and ${layout.windows.length} window bounds.`, { ...session ? { sessionid: session.id } : {} });
+      return layout;
+    }
+    case "restorelayout": {
+      const session = await memory.getsession();
+      const gate = layoutmutationgranted(session, Date.now());
+      if (!gate.allowed) throw new Error(gate.reason);
+      const inputlayout = message;
+      const layout = await memory.getlayout(inputlayout.name ?? "");
+      if (!layout) throw new Error(`No tab layout named ${inputlayout.name ?? ""} is stored yet.`);
+      const open = (await livetabs()).map((tab) => tab.url).filter(Boolean);
+      const urls = layoutrestoreplan(layout, open);
+      const opened = [];
+      for (const url of urls) {
+        const created = await chrome.tabs.create({ url, active: opened.length === 0 });
+        opened.push(created?.id ?? 0);
+      }
+      await audit("layout", `The review panel restored the tab layout ${layout.name}: ${opened.length} tab${opened.length === 1 ? "" : "s"} reopened.`, { ...session ? { sessionid: session.id } : {} });
+      return { name: layout.name, reopened: opened.length };
+    }
+    case "restoresnapshot": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Snapshot restore stays behind the consent gate of an active session.");
+      const inputsnapshot = message;
+      const snapshot2 = (await memory.getsnapshots()).find((item) => item.id === inputsnapshot.id);
+      if (!snapshot2) throw new Error("No stored session snapshot matches the requested id.");
+      const open = (await livetabs()).map((tab) => tab.url).filter(Boolean);
+      const urls = layoutrestoreplan(snapshot2.layout, open);
+      const opened = [];
+      for (const url of urls) {
+        const created = await chrome.tabs.create({ url, active: opened.length === 0 });
+        opened.push(created?.id ?? 0);
+      }
+      await audit("layout", `The review panel restored the session snapshot ${snapshot2.id}: ${opened.length} tab${opened.length === 1 ? "" : "s"} reopened.`, { sessionid: session.id });
+      return { id: snapshot2.id, reopened: opened.length };
+    }
+    case "controltab": {
+      const inputcontrol = message;
+      const state = await togglecontroltab(inputcontrol.enabled === true);
+      const settings = await memory.getsettings();
+      await memory.setsettings({ ...settings, controltab: state.enabled });
+      return state;
+    }
+    case "settasktabceiling": {
+      const inputceiling = message;
+      const settings = await memory.getsettings();
+      const ceiling = typeof inputceiling.ceiling === "number" && Number.isFinite(inputceiling.ceiling) && inputceiling.ceiling >= 0 ? inputceiling.ceiling : void 0;
+      await memory.setsettings({ ...settings, ...ceiling !== void 0 ? { tasktabceiling: ceiling } : {} });
+      await audit("configure", `The user set the concurrent task tab ceiling to ${ceiling === void 0 ? "no ceiling" : ceiling}; the value stays a user choice with no code cap.`);
+      return { tasktabceiling: ceiling };
+    }
+    case "windowstate": {
+      const inputwindow = message;
+      if (typeof inputwindow.windowid !== "number" || !inputwindow.state || !["normal", "maximized", "minimized", "fullscreen"].includes(inputwindow.state)) throw new Error("A numeric window id and a known window state are required.");
+      await chrome.windows.update(inputwindow.windowid, { state: inputwindow.state });
+      await audit("window", `The popup set window ${inputwindow.windowid} to the ${inputwindow.state} state.`);
+      return { windowid: inputwindow.windowid, state: inputwindow.state };
+    }
+    case "closewindow": {
+      const inputclose = message;
+      if (typeof inputclose.windowid !== "number") throw new Error("A numeric window id is required.");
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      const progress = plan ? await memory.getprogress() : void 0;
+      const tasktabids = plan && progress ? trackedtasktabs(progress, plan.id) : [];
+      const count = tasktabsinwindow(await livetabs(), inputclose.windowid, tasktabids);
+      const gate = windowclosegate(count, inputclose.reviewed === true);
+      if (!gate.allowed) throw new Error(gate.reason);
+      await chrome.windows.remove(inputclose.windowid);
+      await audit("window", `The review panel closed window ${inputclose.windowid}${count > 0 ? ` while holding ${count} task tab${count === 1 ? "" : "s"} under explicit review` : ""}.`, { ...session ? { sessionid: session.id } : {} });
+      return { windowid: inputclose.windowid, closed: true };
+    }
     case "stop": {
       const session = await memory.getsession();
       if (session) await memory.setsession({ ...session, stoppedat: Date.now() });