@wenathlan/extension 1.1.35 → 1.1.37

package/extension/dist/sidepanel.js

@@ -1,3 +1,33 @@
+// policy.ts
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha"]);
+var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
+
+// extension/tabscommand.ts
+function switcherlist(tabs, recency, filter) {
+  const needle = filter.trim().toLowerCase();
+  const matches = needle ? tabs.filter((tab) => tab.title.toLowerCase().includes(needle) || tab.url.toLowerCase().includes(needle)) : [...tabs];
+  const lastrun = new Map(recency.map((entry) => [entry.tabid, entry.at]));
+  return [...matches].sort((left, right) => {
+    const leftat = lastrun.get(left.tabid) ?? -1;
+    const rightat = lastrun.get(right.tabid) ?? -1;
+    if (leftat !== rightat) return rightat - leftat;
+    return left.index - right.index;
+  });
+}
+
+// extension/pageforms.ts
+function cardmask(value) {
+  const trimmed = value.trim();
+  if (/^\d[\d\s-]{11,18}$/.test(trimmed)) {
+    const compact = trimmed.replace(/[\s-]/g, "");
+    const last = compact.slice(-4);
+    return `${"\u2022".repeat(Math.max(0, compact.length - 4))}${last}`;
+  }
+  return "\u2022".repeat(trimmed.length);
+}
+
 // extension/sidepanel.ts
 var objective = document.querySelector("#objective");
 var localbutton = document.querySelector("#localplan");
@@ -16,6 +46,8 @@ var bannersroot = document.querySelector("#banners");
 var selectorsroot = document.querySelector("#selectors");
 var trailroot = document.querySelector("#trail");
 var navigationroot = document.querySelector("#navigation");
+var tabswindowsroot = document.querySelector("#tabswindows");
+var formsroot = document.querySelector("#forms");
 var statusnode = document.querySelector("#status");
 var progressnode = document.querySelector("#planprogress");
 var capabilitiestext = document.querySelector("#capabilitiestext");
@@ -48,7 +80,7 @@ function button(label, action, disabled = false) {
   element.addEventListener("click", () => action().catch((error) => status(error instanceof Error ? error.message : String(error), true)));
   return element;
 }
-var previewkinds = ["focus", "inspect", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "clickpoint", "clicktext", "clickaria", "clickname", "resolvexpath", "deriveselector", "fingerprintsection"];
+var previewkinds = ["focus", "inspect", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "clickpoint", "clicktext", "clickaria", "clickname", "resolvexpath", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword"];
 var topictags = [
   { topic: "pointer", kinds: ["movepointer", "clickpoint", "shiftclick", "clicktext", "clickaria", "clickname", "pierceshadow"] },
   { topic: "typing", kinds: ["typetime", "appendtext", "setvalue", "typeedit", "submitsearch"] },
@@ -61,7 +93,9 @@ var topictags = [
   { topic: "observation", kinds: ["a11ytree", "readvisible", "readertree", "readoutline", "readselection", "readopengraph", "readlang", "detectlanguage", "listshadow", "listframes", "readscrollpos"] },
   { topic: "detection", kinds: ["detectlists", "detecttables", "detectinfinitescroll", "detectvirtual", "detectlazy", "detectsticky", "detectscrolllock", "countpages", "classifypage", "fingerprintsection"] },
   { topic: "watch", kinds: ["watchmutate", "watchbanner", "watchfocus", "waitquiet", "readjson", "diffsnapshots", "deriveselector"] },
-  { topic: "navigation", kinds: ["openlink", "openprivate", "reloadcache", "stopnav", "waitload", "waiturl", "followlink", "spanav", "spawait", "rewritequery", "setfragment", "navlist", "navprofile", "detecthttp", "readredirects", "readfinalurl", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "trailaudit", "pausenav", "navintent", "navrate", "openclipboard", "checksafe", "batchopen"] }
+  { topic: "navigation", kinds: ["openlink", "openprivate", "reloadcache", "stopnav", "waitload", "waiturl", "followlink", "spanav", "spawait", "rewritequery", "setfragment", "navlist", "navprofile", "detecthttp", "readredirects", "readfinalurl", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "trailaudit", "pausenav", "navintent", "navrate", "openclipboard", "checksafe", "batchopen"] },
+  { topic: "tabs", kinds: ["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"] },
+  { topic: "forms", kinds: ["fillform", "filllabel", "fillplaceholder", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "submitform", "readerrors", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "handoffcaptcha", "fillcard", "fillcode", "consentpassword", "skiphoneypot", "detectlogin", "detecttemplate"] }
 ];
 function steptopic(kind) {
   return topictags.find((tag) => tag.kinds.includes(kind))?.topic;
@@ -579,6 +613,358 @@ function rendernavigation(context) {
     navigationroot.append(list);
   }
 }
+function rendertabswindows(context) {
+  if (!tabswindowsroot) return;
+  tabswindowsroot.replaceChildren();
+  const tabs = context.tabs ?? [];
+  const badges = context.badges ?? [];
+  const metas = context.tabmetas ?? [];
+  const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
+  const gauge = context.tasktabgauge ?? { used: 0, ceiling: void 0, over: false };
+  const budget = document.createElement("p");
+  budget.className = gauge.over ? "bannercard" : "";
+  budget.textContent = `task tab budget: ${gauge.used} tab${gauge.used === 1 ? "" : "s"} with active tasks${gauge.ceiling !== void 0 ? ` of the user configured ceiling ${gauge.ceiling}` : " with no user ceiling configured"}${gauge.over ? " \u2014 over the reviewed budget" : ""}`;
+  tabswindowsroot.append(budget);
+  const ceilinginput = document.createElement("input");
+  ceilinginput.type = "number";
+  ceilinginput.min = "0";
+  ceilinginput.placeholder = gauge.ceiling !== void 0 ? String(gauge.ceiling) : "no ceiling";
+  ceilinginput.setAttribute("aria-label", "concurrent task tab ceiling");
+  const ceilingbutton = button("Save task tab ceiling", async () => {
+    await request({ kind: "settasktabceiling", ceiling: ceilinginput.value === "" ? void 0 : Number(ceilinginput.value) });
+    status(`Task tab ceiling saved as ${ceilinginput.value === "" ? "no ceiling" : ceilinginput.value}; the value stays a user choice.`);
+    await refresh();
+  });
+  tabswindowsroot.append(ceilinginput, " ", ceilingbutton);
+  const switcherheading = document.createElement("p");
+  switcherheading.textContent = "quick switcher (ordered by recency, filter by title or url):";
+  tabswindowsroot.append(switcherheading);
+  const filterinput = document.createElement("input");
+  filterinput.type = "search";
+  filterinput.placeholder = "filter open tabs";
+  filterinput.setAttribute("aria-label", "quick switcher filter");
+  const switchlist = document.createElement("ul");
+  const renderswitchlist = () => {
+    switchlist.replaceChildren();
+    const ordered = switcherlist(tabs, [], filterinput.value).slice(0, 10);
+    for (const tab of ordered) {
+      const item = document.createElement("li");
+      const jump = document.createElement("button");
+      jump.type = "button";
+      const badge = badges.find((entry) => entry.tabid === tab.tabid);
+      const meta = metas.find((entry) => entry.tabid === tab.tabid);
+      jump.textContent = `${tab.title || tab.url}${tab.pinned ? " \u{1F4CC}" : ""}${tab.audible || tab.muted ? ` ${tab.muted ? "\u{1F507}" : "\u{1F50A}"}` : ""}${badge ? ` [${badge.label}]` : ""}${meta && meta.labels.length > 0 ? ` (${meta.labels.join(", ")})` : ""}`;
+      jump.addEventListener("click", () => request({ kind: "jumptotab", tabid: tab.tabid }).then(() => status(`Jumped to tab ${tab.tabid}.`)).catch((error) => status(error instanceof Error ? error.message : String(error), true)));
+      item.append(jump);
+      switchlist.append(item);
+    }
+    if (ordered.length === 0) {
+      const empty = document.createElement("li");
+      empty.textContent = "no open tab matches the filter";
+      switchlist.append(empty);
+    }
+  };
+  filterinput.addEventListener("input", renderswitchlist);
+  tabswindowsroot.append(filterinput, switchlist);
+  renderswitchlist();
+  const searchinput = document.createElement("input");
+  searchinput.type = "search";
+  searchinput.placeholder = "search across open tabs by title and url";
+  searchinput.setAttribute("aria-label", "searchtabs text");
+  const searchresults = document.createElement("ul");
+  const searchbutton = button("Run searchtabs", async () => {
+    const result = await request({ kind: "tabsearch", text: searchinput.value });
+    searchresults.replaceChildren();
+    for (const tab of result.matches.slice(0, 10)) {
+      const item = document.createElement("li");
+      const jump = document.createElement("button");
+      jump.type = "button";
+      jump.textContent = `${tab.title || tab.url} \xB7 ${tab.url}`;
+      jump.addEventListener("click", () => request({ kind: "jumptotab", tabid: tab.tabid }).then(() => status(`Jumped to tab ${tab.tabid}.`)).catch((error) => status(error instanceof Error ? error.message : String(error), true)));
+      item.append(jump);
+      searchresults.append(item);
+    }
+    status(`searchtabs matched ${result.matches.length} open tab${result.matches.length === 1 ? "" : "s"}.`);
+  });
+  tabswindowsroot.append(searchinput, " ", searchbutton, searchresults);
+  const clones = context.clones ?? [];
+  for (const clone of clones.slice(0, 3)) {
+    const warning = document.createElement("p");
+    warning.className = "bannercard";
+    warning.textContent = `duplicate tab warning: ${clone.tabids.length} open tabs share the url ${clone.url} (tabs ${clone.tabids.join(", ")})`;
+    tabswindowsroot.append(warning);
+  }
+  const groups = context.tabgroups ?? [];
+  if (groups.length > 0) {
+    const groupsheading = document.createElement("p");
+    groupsheading.textContent = "tab groups with colors and collapse states:";
+    tabswindowsroot.append(groupsheading);
+    const grouplist = document.createElement("ul");
+    for (const group of groups.slice(0, 6)) {
+      const item = document.createElement("li");
+      item.textContent = `${group.name} \xB7 ${group.color} \xB7 ${group.collapsed ? "collapsed" : "expanded"} \xB7 ${group.tabids.length} member tab${group.tabids.length === 1 ? "" : "s"}`;
+      grouplist.append(item);
+    }
+    tabswindowsroot.append(grouplist);
+  }
+  const windows = context.windows ?? [];
+  if (windows.length > 0) {
+    const windowsheading = document.createElement("p");
+    windowsheading.textContent = "windows with layouts and bounds:";
+    tabswindowsroot.append(windowsheading);
+    const windowlist = document.createElement("ul");
+    for (const item of windows.slice(0, 6)) {
+      const entry = document.createElement("li");
+      entry.textContent = `window ${item.windowid} \xB7 ${item.state} \xB7 bounds ${item.left}\xD7${item.top} ${item.width}\xD7${item.height}${item.incognito ? " \xB7 incognito, grants not inherited" : ""}${item.focused ? " \xB7 focused" : ""}`;
+      const closebutton = button("Close window", async () => {
+        const tasktabids = context.progress?.tasktabs ?? [];
+        const tabsoftask = (context.tabs ?? []).filter((tab) => tab.windowid === item.windowid && tasktabids.includes(tab.tabid));
+        const reviewed = tabsoftask.length > 1 ? window.confirm(`This window holds ${tabsoftask.length} task tabs. Close it anyway under explicit review?`) : true;
+        await request({ kind: "closewindow", windowid: item.windowid, reviewed });
+        status(`Closed window ${item.windowid}.`);
+        await refresh();
+      });
+      entry.append(" ", closebutton);
+      windowlist.append(entry);
+    }
+    tabswindowsroot.append(windowlist);
+  }
+  const layoutcontrols = document.createElement("p");
+  const layoutname = document.createElement("input");
+  layoutname.type = "text";
+  layoutname.placeholder = "layout name";
+  layoutname.setAttribute("aria-label", "layout name");
+  const savebutton = button("Save layout", async () => {
+    if (!active) {
+      status("Layout save stays inside an active session.", true);
+      return;
+    }
+    await request({ kind: "savelayout", name: layoutname.value });
+    status(`Saved the tab layout ${layoutname.value}.`);
+    await refresh();
+  });
+  const restorebutton = button("Restore layout", async () => {
+    if (!active) {
+      status("Layout restore stays inside an active session.", true);
+      return;
+    }
+    const result = await request({ kind: "restorelayout", name: layoutname.value });
+    status(`Restored the tab layout ${layoutname.value}: ${result.reopened} tab${result.reopened === 1 ? "" : "s"} reopened.`);
+    await refresh();
+  });
+  layoutcontrols.append(layoutname, " ", savebutton, " ", restorebutton);
+  tabswindowsroot.append(layoutcontrols);
+  const layouts = context.layouts ?? [];
+  if (layouts.length > 0) {
+    const layoutlist = document.createElement("ul");
+    for (const layout of layouts.slice(0, 4)) {
+      const item = document.createElement("li");
+      item.textContent = `${layout.name} \xB7 ${layout.tabs.length} tab${layout.tabs.length === 1 ? "" : "s"} \xB7 ${layout.groups.length} group${layout.groups.length === 1 ? "" : "s"} \xB7 ${layout.windows.length} window bound${layout.windows.length === 1 ? "" : "s"} \xB7 saved ${new Date(layout.savedat).toLocaleString()}`;
+      layoutlist.append(item);
+    }
+    tabswindowsroot.append(layoutlist);
+  }
+  const snapshots = context.snapshots ?? [];
+  if (snapshots.length > 0) {
+    const snapcard = document.createElement("div");
+    snapcard.className = "bannercard";
+    const snaptitle = document.createElement("p");
+    snaptitle.textContent = `session snapshot card: ${snapshots.length} snapshot${snapshots.length === 1 ? "" : "s"} stored`;
+    snapcard.append(snaptitle);
+    for (const snapshot of snapshots.slice(0, 3)) {
+      const row = document.createElement("p");
+      row.textContent = `${snapshot.layout.tabs.length} tabs \xB7 captured ${new Date(snapshot.capturedat).toLocaleString()}`;
+      const restore = button("Restore snapshot", async () => {
+        const result = await request({ kind: "restoresnapshot", id: snapshot.id });
+        status(`Restored the session snapshot: ${result.reopened} tab${result.reopened === 1 ? "" : "s"} reopened.`);
+        await refresh();
+      });
+      row.append(" ", restore);
+      snapcard.append(row);
+    }
+    tabswindowsroot.append(snapcard);
+  }
+  const controlcard = document.createElement("div");
+  controlcard.className = "bannercard";
+  const controlstate = context.controltab;
+  const completed = context.progress?.completedsteps.length ?? 0;
+  const total = context.plan?.steps.length ?? 0;
+  controlcard.textContent = `pinned control tab feed: ${controlstate?.enabled ? `open as tab ${controlstate.tabid} with the live task status ${completed} of ${total} reviewed steps executed` : "disabled"}${context.plan ? ` \xB7 ${context.plan.state}` : " \xB7 no plan"}`;
+  const controlbutton = button(controlstate?.enabled ? "Close pinned control tab" : "Open pinned control tab", async () => {
+    await request({ kind: "controltab", enabled: !controlstate?.enabled });
+    status(controlstate?.enabled ? "The pinned control tab was closed." : "The pinned control tab was opened with the live task feed.");
+    await refresh();
+  });
+  controlcard.append(" ", controlbutton);
+  tabswindowsroot.append(controlcard);
+}
+function renderforms(context) {
+  if (!formsroot) return;
+  formsroot.replaceChildren();
+  const outcomes = context.outcomes ?? [];
+  const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
+  const opencaptcha = (context.captchas ?? []).find((handoff) => !handoff.resolved);
+  if (opencaptcha) {
+    const card = document.createElement("div");
+    card.className = "bannercard";
+    card.textContent = `Captcha handoff open on ${opencaptcha.origin}: control is yours and the plan waits until you resolve it.`;
+    card.append(" ", button("Captcha resolved", async () => {
+      await request({ kind: "resolvecaptcha" });
+      status("Captcha handoff resolved; the plan continues.");
+      await refresh();
+    }));
+    formsroot.append(card);
+  }
+  const detections = context.detections ?? [];
+  if (detections.length > 0) {
+    const badges = document.createElement("p");
+    badges.textContent = `template badges: ${detections.slice(0, 6).map((record) => `${record.kind} on ${record.origin}${record.markers.length > 0 ? ` (${record.markers.join(", ")})` : ""}`).join(" \xB7 ")}`;
+    formsroot.append(badges);
+  }
+  const mapoutcome = [...outcomes].reverse().find((outcome) => outcome.details?.report !== void 0 && outcome.details?.count !== void 0);
+  const skippedselectors = new Set(outcomes.flatMap((outcome) => Array.isArray(outcome.details?.skipped) ? outcome.details?.skipped : []).map((trap) => trap.selector));
+  if (mapoutcome) {
+    const report = mapoutcome.details?.report;
+    const heading = document.createElement("p");
+    heading.textContent = `form map${report.form ? ` of ${report.form}` : ""}: ${report.fields.length} detected field${report.fields.length === 1 ? "" : "s"} with their kinds${skippedselectors.size > 0 ? `; ${skippedselectors.size} honeypot field${skippedselectors.size === 1 ? "" : "s"} highlighted as skipped` : ""}`;
+    formsroot.append(heading);
+    const list = document.createElement("ul");
+    for (const field of report.fields.slice(0, 10)) {
+      const item = document.createElement("li");
+      const skipped = skippedselectors.has(field.selector);
+      item.textContent = `${field.label || field.selector} \xB7 ${field.kind}${field.matched ? "" : " \xB7 unmatched"}${skipped ? " \xB7 honeypot, skipped" : ""}`;
+      list.append(item);
+    }
+    formsroot.append(list);
+  }
+  const valuesoutcome = [...outcomes].reverse().find((outcome) => Array.isArray(outcome.details?.values) && outcome.details?.locale !== void 0);
+  if (valuesoutcome) {
+    const values = valuesoutcome.details?.values;
+    const locale = typeof valuesoutcome.details?.locale === "string" ? valuesoutcome.details.locale : "en";
+    const seed = typeof valuesoutcome.details?.seed === "number" ? valuesoutcome.details.seed : 1;
+    const heading = document.createElement("p");
+    heading.textContent = `generated values (locale ${locale}, seed ${seed}) with a regenerate button per field:`;
+    formsroot.append(heading);
+    const list = document.createElement("ul");
+    for (const entry of values.slice(0, 10)) {
+      const item = document.createElement("li");
+      item.textContent = `${entry.label} \xB7 ${entry.kind} \xB7 ${entry.value}`;
+      item.append(" ", button("Regenerate", async () => {
+        const regenerated = await request({ kind: "regeneratevalue", field: entry.kind, locale, seed: seed + 1 });
+        status(`Regenerated ${entry.label}: ${regenerated.value}.`);
+      }));
+      list.append(item);
+    }
+    formsroot.append(list);
+  }
+  const cardoutcome = [...outcomes].reverse().find((outcome) => Array.isArray(outcome.details?.segments));
+  if (cardoutcome) {
+    const segments = cardoutcome.details?.segments;
+    const cardline = document.createElement("p");
+    cardline.textContent = `card fill segments (masked): ${segments.map((segment) => `${segment.label} ${cardmask(segment.masked)}`).join(" \xB7 ")}`;
+    formsroot.append(cardline);
+  }
+  const profiles = context.profiles ?? [];
+  if (profiles.length > 0) {
+    const heading = document.createElement("p");
+    heading.textContent = "saved form profiles with origin grants:";
+    formsroot.append(heading);
+    const list = document.createElement("ul");
+    for (const profile of profiles.slice(0, 6)) {
+      const item = document.createElement("li");
+      item.textContent = `${profile.name} \xB7 ${profile.fields.length} field${profile.fields.length === 1 ? "" : "s"} \xB7 grants ${profile.grants.join(", ")} \xB7 saved ${new Date(profile.savedat).toLocaleString()}`;
+      item.append(" ", button("Apply", async () => {
+        const applied = await request({ kind: "applyprofile", name: profile.name });
+        pickhint(`profile hint: ${profile.name} with ${applied.profile.fields.length} reviewed field entries`);
+      }), " ", button("Remove", async () => {
+        await request({ kind: "removeprofile", name: profile.name });
+        status(`Form profile ${profile.name} removed.`);
+        await refresh();
+      }));
+      list.append(item);
+    }
+    formsroot.append(list);
+  }
+  const pending = (context.tickets ?? []).filter((ticket) => ticket.approved === void 0);
+  for (const ticket of pending) {
+    const card = document.createElement("div");
+    card.className = "bannercard";
+    const title = document.createElement("p");
+    title.textContent = `asksubmit for form ${ticket.form || "the reviewed form"} \xB7 values hash ${ticket.valueshash}`;
+    card.append(title);
+    const askoutcome = [...outcomes].reverse().find((outcome) => Array.isArray(outcome.details?.values) && outcome.details?.ticket !== void 0);
+    const values = askoutcome?.details?.values;
+    if (values) {
+      const diff = document.createElement("ul");
+      for (const entry of values.slice(0, 10)) {
+        const item = document.createElement("li");
+        item.textContent = `${entry.label}: ${entry.value}`;
+        diff.append(item);
+      }
+      card.append(diff);
+    } else {
+      const note = document.createElement("p");
+      note.textContent = "The full values diff appears here once the asksubmit step reads the form.";
+      card.append(note);
+    }
+    card.append(button("Approve submission", async () => {
+      await request({ kind: "approvesubmit", id: ticket.id, approved: true });
+      status("Submission approved; the reviewed submitform step may run.");
+      await refresh();
+    }), " ", button("Decline", async () => {
+      await request({ kind: "approvesubmit", id: ticket.id, approved: false });
+      status("Submission declined.");
+      await refresh();
+    }));
+    formsroot.append(card);
+  }
+  const wizards = context.wizards?.wizards ?? [];
+  if (wizards.length > 0) {
+    const wizard = wizards[0];
+    const heading = document.createElement("p");
+    const indicators = Array.from({ length: wizard.steps }, (_, index) => `${index < wizard.index ? wizard.completed[index] ? "\u2713" : "\xB7" : "\u25CB"}`).join(" ");
+    heading.textContent = `wizard progress: step ${Math.min(wizard.index + 1, wizard.steps)} of ${wizard.steps} ${indicators}`;
+    formsroot.append(heading);
+  }
+  const picks = context.wizards?.picks ?? [];
+  if (picks.length > 0) {
+    const pickline = document.createElement("p");
+    pickline.textContent = `typeahead picks: ${picks.slice(0, 6).map((pick) => `"${pick.pick}" for "${pick.query}"`).join(" \xB7 ")}`;
+    formsroot.append(pickline);
+  }
+  const reports = context.errorreports ?? [];
+  if (reports.length > 0) {
+    const heading = document.createElement("p");
+    heading.textContent = "inline error reports with field refs for correction loops:";
+    formsroot.append(heading);
+    const list = document.createElement("ul");
+    for (const report of reports.slice(0, 3)) {
+      const item = document.createElement("li");
+      item.textContent = `${report.form || "the reviewed form"}: ${report.errors.map((error) => `${error.field} \u2014 ${error.message}`).join("; ") || "no message"}`;
+      list.append(item);
+    }
+    formsroot.append(list);
+  }
+  const codecard = document.createElement("div");
+  codecard.className = "bannercard";
+  const codetitle = document.createElement("p");
+  codetitle.textContent = active ? "one time code entry (stored behind the consent gate of the active session):" : "one time code entry needs an active session first.";
+  codecard.append(codetitle);
+  if (active) {
+    const codeinput = document.createElement("input");
+    codeinput.type = "text";
+    codeinput.inputMode = "numeric";
+    codeinput.placeholder = context.codeentry ? "a reviewed code is stored" : "one time code";
+    codeinput.setAttribute("aria-label", "one time code");
+    const storebutton = button("Store reviewed code", async () => {
+      await request({ kind: "storecode", code: codeinput.value });
+      status("The reviewed one time code is stored behind the consent gate.");
+      await refresh();
+    });
+    codecard.append(codeinput, " ", storebutton);
+  }
+  formsroot.append(codecard);
+}
 function rendercapabilities(report) {
   if (!capabilitiestext) return;
   if (!report) {
@@ -624,6 +1010,8 @@ async function refresh() {
   renderselectors(context.selectors ?? []);
   rendertrail(context.trail?.trail ?? []);
   rendernavigation(context);
+  rendertabswindows(context);
+  renderforms(context);
   renderaudit(context.audit);
   rendercapabilities(context.capabilities);
   if (context.session?.pausedat) status("Session paused. Reviewed actions are blocked until resume.");