@wenathlan/extension 1.1.38 → 1.1.39

package/extension/dist/background.js

@@ -619,23 +619,136 @@ var sessionmemory = class {
   async getexports() {
     return await this.adapter.get("exports") ?? [];
   }
+  /** Removes one exported data artifact by id and reports whether it existed. */
+  async removeexport(id) {
+    const records = await this.getexports();
+    const remaining = records.filter((item) => item.id !== id);
+    await this.adapter.set("exports", remaining);
+    return remaining.length !== records.length;
+  }
+  /** Removes one run store artifact by id and reports whether it existed. */
+  async removeartifact(id) {
+    const records = await this.getartifacts();
+    const remaining = records.filter((item) => item.id !== id);
+    await this.adapter.set("artifacts", remaining);
+    return remaining.length !== records.length;
+  }
+  /** Stores one batch download file record with its state, path and checksum, replacing the previous record of that id. */
+  async setdownload(record2) {
+    const records = (await this.adapter.get("downloads") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("downloads", [record2, ...records]);
+  }
+  /** Returns every batch download file record with its state, path and checksum, newest first. */
+  async getdownloads() {
+    return await this.adapter.get("downloads") ?? [];
+  }
+  /** Records one captured network log record; netlog retention is a user setting and an absent value keeps every record. */
+  async addnetlog(record2) {
+    const records = await this.getnetlog();
+    const combined = [record2, ...records];
+    const retention = (await this.getsettings())?.netlogretention;
+    await this.adapter.set("netlog", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Returns the captured network log of the run with its step correlation, newest first. */
+  async getnetlog() {
+    return await this.adapter.get("netlog") ?? [];
+  }
+  /** Stores one clipboard consent record with its prompt and origin, replacing the previous record of that id. */
+  async setclipconsent(record2) {
+    const records = (await this.adapter.get("clipconsents") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("clipconsents", [record2, ...records]);
+  }
+  /** Returns every clipboard consent record with its prompt and origin, newest first. */
+  async getclipconsents() {
+    return await this.adapter.get("clipconsents") ?? [];
+  }
+  /** Records one clipboard entry hash with its origin provenance; the payload text itself never persists. */
+  async addclip(entry) {
+    const records = await this.getclips();
+    await this.adapter.set("clips", [entry, ...records]);
+  }
+  /** Returns every clipboard entry hash with its kind and origin provenance, newest first. */
+  async getclips() {
+    return await this.adapter.get("clips") ?? [];
+  }
+  /** Stores one quarantine entry with its scan verdict, replacing the previous entry of that id. */
+  async setquarantine(entry) {
+    const records = (await this.adapter.get("quarantines") ?? []).filter((item) => item.id !== entry.id);
+    await this.adapter.set("quarantines", [entry, ...records]);
+  }
+  /** Returns every quarantine entry with its scan verdict and release ref, newest first. */
+  async getquarantines() {
+    return await this.adapter.get("quarantines") ?? [];
+  }
+  /** Stores the reviewed cleanup rule set of the run, replacing the previous set. */
+  async setcleanuprules(rules) {
+    return this.adapter.set("cleanuprules", rules);
+  }
+  /** Returns the reviewed cleanup rule set of the run. */
+  async getcleanuprules() {
+    return await this.adapter.get("cleanuprules") ?? [];
+  }
+  /** Records one cleanup run in the run history. */
+  async addcleanuprun(run) {
+    const records = await this.getcleanupruns();
+    await this.adapter.set("cleanupruns", [run, ...records]);
+  }
+  /** Returns every cleanup run history record with removed and kept counts, newest first. */
+  async getcleanupruns() {
+    return await this.adapter.get("cleanupruns") ?? [];
+  }
+  /** Stores the capture naming counters of one task, replacing the previous counters of that task. */
+  async setcapturecounter(counter) {
+    const records = (await this.adapter.get("capturecounters") ?? []).filter((item) => item.taskid !== counter.taskid);
+    await this.adapter.set("capturecounters", [counter, ...records]);
+  }
+  /** Returns every stored capture naming counter per task, newest first. */
+  async getcapturecounters() {
+    return await this.adapter.get("capturecounters") ?? [];
+  }
+  /** Replaces the artifact inventory the cleanup sweeper plans against. */
+  async setinventory(entries) {
+    return this.adapter.set("inventory", entries);
+  }
+  /** Returns the artifact inventory with sizes and ages for the cleanup sweeper. */
+  async getinventory() {
+    return await this.adapter.get("inventory") ?? [];
+  }
+  /** Stores one user configured virus scanning hook, replacing the previous hook of that scanner name. */
+  async setscanhook(config) {
+    const records = (await this.adapter.get("scanhooks") ?? []).filter((item) => item.scanner !== config.scanner);
+    await this.adapter.set("scanhooks", [config, ...records]);
+  }
+  /** Returns every configured virus scanning hook, newest first. */
+  async getscanhooks() {
+    return await this.adapter.get("scanhooks") ?? [];
+  }
+  /** Stores the armed mime interception filters of the run, newest first. */
+  async setmimefilters(filters) {
+    return this.adapter.set("mimefilters", filters);
+  }
+  /** Returns the armed mime interception filters of the run, newest first. */
+  async getmimefilters() {
+    return await this.adapter.get("mimefilters") ?? [];
+  }
 };
 function randomid() {
   return crypto.randomUUID();
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract"]);
-var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword"]);
+var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "pausedownload", "resumedownload", "verifydownload", "writeclipboard", "quarantinedownload", "scanvirus"]);
 var tabscommandactions = /* @__PURE__ */ new Set(["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"]);
 var formactions = /* @__PURE__ */ new Set(["fillform", "filllabel", "fillplaceholder", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "submitform", "readerrors", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "handoffcaptcha", "fillcard", "fillcode", "consentpassword", "skiphoneypot", "detectlogin", "detecttemplate"]);
 var datasetactions = /* @__PURE__ */ new Set(["scrapetable", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "importcsv", "looprows", "transformvalues", "deduperows", "paginateextract", "mergepages", "stamplerows", "previewgrid", "streamdisk", "resumeextract", "logprovenance"]);
 var exportactions = /* @__PURE__ */ new Set(["exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk"]);
+var filesactions = /* @__PURE__ */ new Set(["batchdownload", "pausedownload", "resumedownload", "verifydownload", "interceptmime", "exportnetlog", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "namecaptures", "cleanupartifacts"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
 var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
@@ -671,6 +784,9 @@ function requiredcapability(kind) {
   if (kind === "downloadfile") return "downloads";
   if (kind === "openclipboard") return "clipboardRead";
   if (kind === "copytable") return "clipboardWrite";
+  if (kind === "batchdownload" || kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "interceptmime" || kind === "quarantinedownload" || kind === "scanvirus") return "downloads";
+  if (kind === "readclipboard") return "clipboardRead";
+  if (kind === "writeclipboard" || kind === "copyscreen") return "clipboardWrite";
   if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
   if (tabscommandactions.has(kind)) return "tabs";
   return void 0;
@@ -690,6 +806,9 @@ function isdatasetkind(kind) {
 function isexportkind(kind) {
   return exportactions.has(kind);
 }
+function isfileskind(kind) {
+  return filesactions.has(kind);
+}
 function exportgranted(session, origin) {
   if (!origingranted(session, origin)) return { allowed: false, reason: `The export of extracted data from ${origin} needs the session origin grants before it leaves local memory.` };
   return { allowed: true };
@@ -874,6 +993,88 @@ function validatedatagrammar(step, options, origin) {
   if (kind === "logprovenance" && !isnonempty(options.artifact)) return { allowed: false, reason: "A reviewed artifact id or name is required in options." };
   return { allowed: true };
 }
+function validatedownloadspec(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed downloadspec with a url list is required in options." };
+  const spec = value;
+  if (!Array.isArray(spec.urls) || spec.urls.length === 0 || !spec.urls.every((url) => ishttpsurl(url))) return { allowed: false, reason: "The reviewed downloadspec needs a non-empty list of HTTPS urls." };
+  if (spec.filename !== void 0 && !isnonempty(spec.filename)) return { allowed: false, reason: "The reviewed downloadspec filename rule must be a non-empty string." };
+  if (spec.complete !== void 0 && spec.complete !== "size" && spec.complete !== "checksum") return { allowed: false, reason: "The reviewed downloadspec completion criterion must be size or checksum." };
+  return { allowed: true };
+}
+function validatemimefilter(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed mimefilter with include and exclude patterns is required in options." };
+  const filter = value;
+  if (!Array.isArray(filter.include) || filter.include.length === 0 || !filter.include.every((pattern) => isnonempty(pattern))) return { allowed: false, reason: "The reviewed mimefilter needs a non-empty list of include patterns." };
+  if (filter.exclude !== void 0 && (!Array.isArray(filter.exclude) || !filter.exclude.every((pattern) => isnonempty(pattern)))) return { allowed: false, reason: "The reviewed mimefilter exclude patterns must be a list of non-empty strings." };
+  if (filter.default !== "deny" && filter.default !== "allow") return { allowed: false, reason: "The reviewed mimefilter needs the deny or allow default for unlisted mime types." };
+  return { allowed: true };
+}
+function validatecleanuprule(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed cleanuprule with an age, a kind and a keep policy is required." };
+  const rule = value;
+  if (typeof rule.age !== "number" || !Number.isFinite(rule.age) || rule.age <= 0) return { allowed: false, reason: "The reviewed cleanup age window must be a positive number of milliseconds with no code ceiling." };
+  if (!isnonempty(rule.kind)) return { allowed: false, reason: "The reviewed cleanup rule needs a non-empty artifact kind, or any to match every kind." };
+  if (rule.keep !== "none" && rule.keep !== "latest" && rule.keep !== "all") return { allowed: false, reason: "The reviewed cleanup keep policy must be none, latest or all." };
+  return { allowed: true };
+}
+function validatefilesgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "batchdownload") {
+    const speccheck = validatedownloadspec(options.downloadspec);
+    if (!speccheck.allowed) return speccheck;
+    if (options.concurrent !== void 0 && (typeof options.concurrent !== "number" || !Number.isInteger(options.concurrent) || options.concurrent < 1)) return { allowed: false, reason: "The reviewed concurrent download window must be a positive integer with no code ceiling." };
+  }
+  if (kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "quarantinedownload" || kind === "scanvirus") {
+    if (!isnonempty(step.value)) return { allowed: false, reason: "A reviewed download or quarantine reference is required." };
+    if (kind === "verifydownload") {
+      if (options.checksum !== void 0 && !isnonempty(options.checksum)) return { allowed: false, reason: "The reviewed expected checksum must be a non-empty string." };
+      if (options.bytes !== void 0 && (typeof options.bytes !== "number" || !Number.isFinite(options.bytes) || options.bytes < 0)) return { allowed: false, reason: "The reviewed expected size must be zero or a positive number of bytes." };
+    }
+    if (kind === "scanvirus" && options.scanner !== void 0 && !isnonempty(options.scanner)) return { allowed: false, reason: "The reviewed scanner name must be a non-empty string." };
+    if (kind === "quarantinedownload" && options.reason !== void 0 && !isnonempty(options.reason)) return { allowed: false, reason: "The reviewed quarantine reason must be a non-empty string." };
+  }
+  if (kind === "interceptmime") {
+    const filtercheck = validatemimefilter(options.mimefilter);
+    if (!filtercheck.allowed) return filtercheck;
+  }
+  if (kind === "readclipboard") {
+    if (!isnonempty(options.consentref)) return { allowed: false, reason: "A clipboard read requires a reviewed consent ref of an approved consent prompt in options." };
+    if (options.prompt !== void 0 && !isnonempty(options.prompt)) return { allowed: false, reason: "The reviewed clipboard consent prompt must be a non-empty string." };
+  }
+  if (kind === "exportnetlog" && options.stepid !== void 0 && !isnonempty(options.stepid)) return { allowed: false, reason: "The reviewed netlog step filter must be a non-empty step id." };
+  if (kind === "namecaptures") {
+    if (!isnonempty(options.task)) return { allowed: false, reason: "A reviewed task id is required in options for capture naming." };
+    if (options.steps !== void 0 && (!Array.isArray(options.steps) || options.steps.length === 0 || !options.steps.every((item) => isnonempty(item)))) return { allowed: false, reason: "The reviewed capture steps must be a non-empty list of step ids when present." };
+    if (options.extension !== void 0 && !isnonempty(options.extension)) return { allowed: false, reason: "The reviewed capture extension must be a non-empty string." };
+  }
+  if (kind === "cleanupartifacts" && options.rules !== void 0) {
+    const rules = options.rules;
+    if (!Array.isArray(rules) || rules.length === 0) return { allowed: false, reason: "The reviewed cleanup rules must be a non-empty list when present." };
+    for (const item of rules) {
+      const rulecheck = validatecleanuprule(item);
+      if (!rulecheck.allowed) return rulecheck;
+    }
+  }
+  return { allowed: true };
+}
+function clipboardconsentgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const consentref = options.consentref;
+  if (typeof consentref !== "string" || !consentref.trim()) return { allowed: false, reason: "A clipboard read requires a reviewed consent ref in options." };
+  return { allowed: true };
+}
+function quarantinereleasegranted(entry) {
+  if (entry.scan !== "clean") return { allowed: false, reason: `The quarantined file ${entry.path} cannot leave quarantine with the ${entry.scan} scan verdict; only a clean verdict releases it.` };
+  return { allowed: true };
+}
+function maskclipboard(payload) {
+  return `[clipboard payload of ${payload.length} character${payload.length === 1 ? "" : "s"}]`;
+}
 function submitreviewgranted(steps, submitid) {
   const position = steps.findIndex((candidate) => candidate.id === submitid);
   const asked = steps.some((candidate, index) => candidate.kind === "asksubmit" && (position === -1 || index < position));
@@ -1400,6 +1601,10 @@ function validatestep(step, origin) {
     const datacheck = validatedatagrammar(step, options, origin);
     if (!datacheck.allowed) return datacheck;
   }
+  if (isfileskind(step.kind)) {
+    const filescheck = validatefilesgrammar(step, options);
+    if (!filescheck.allowed) return filescheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -1454,6 +1659,11 @@ function canexecute(input) {
     const consentgate = passwordconsentgranted(input.step);
     if (!consentgate.allowed) return consentgate;
   }
+  if (input.step.kind === "readclipboard") {
+    const clipgate = clipboardconsentgranted(input.step);
+    if (!clipgate.allowed) return clipgate;
+  }
+  if (input.step.kind === "interceptmime" && !origingranted(input.session, input.origin)) return { allowed: false, reason: "The download interception is outside the session origin grants." };
   if (input.step.kind === "openlink" || input.step.kind === "openprivate" || input.step.kind === "batchopen" || input.step.kind === "prefetch" || input.step.kind === "deeplink" || input.step.kind === "reopentab") {
     let options = {};
     try {
@@ -1555,9 +1765,18 @@ function recordwizardstep(progress, planid, stepid, state, now) {
   const outcome = { stepid, ok: done, summary: `Wizard step ${executed} of ${state.steps} ${done ? "completed the wizard" : "executed"}.`, details: { wizard: { index: state.index, steps: state.steps, completed: [...state.completed] } }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function downloadshare(completed, total) {
+  if (!Number.isFinite(total) || total <= 0) return 0;
+  return Math.min(1, Math.max(0, completed) / total);
+}
+function recorddownload(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.state === "complete", summary: `Download ${entry.index + 1} of ${entry.url} ended in the ${entry.state} state.`, details: { download: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.38";
+var packageversion = "1.1.39";
 
 // types.ts
 var protocolversion = packageversion;
@@ -1674,6 +1893,15 @@ function extractionreport(input) {
 function provenancereport(input) {
   return { version: protocolversion, records: input.records };
 }
+function downloadreport(input) {
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, downloads: input.downloads });
+}
+function netlogreport(input) {
+  return { version: protocolversion, records: input.records };
+}
+function quarantinereport(input) {
+  return { version: protocolversion, entries: input.entries };
+}
 
 // extension/browsertabs.ts
 var browserkinds = /* @__PURE__ */ new Set(["tablist", "tabcreate", "tabactivate", "tabclose", "tabreload", "tabsnapshot", "windowlist", "windowcreate", "windowclose", "zoomset", "windowresize", "downloadfile"]);
@@ -2002,13 +2230,13 @@ function presshold(holds, hold) {
   return { holds: [...holds, hold], ok: true };
 }
 function releasehold(holds, holdid, releasedat) {
-  let released;
+  let released2;
   const next = holds.map((hold) => {
     if (hold.holdid !== holdid || hold.releasedat !== void 0) return hold;
-    released = { ...hold, releasedat };
-    return released;
+    released2 = { ...hold, releasedat };
+    return released2;
   });
-  return { holds: next, ...released ? { released } : {} };
+  return { holds: next, ...released2 ? { released: released2 } : {} };
 }
 function heldkeys(holds, tabid2) {
   return holds.filter((hold) => hold.releasedat === void 0 && (tabid2 === void 0 || hold.tabid === void 0 || hold.tabid === tabid2));
@@ -2691,6 +2919,153 @@ function mergetaskrules(existing, taskid, transforms, dedupekeys, at) {
   };
 }
 
+// extension/filescommand.ts
+var downloadtransitions = {
+  queued: ["running", "complete", "failed"],
+  running: ["paused", "complete", "failed"],
+  paused: ["running", "failed"],
+  complete: [],
+  failed: []
+};
+function transitionallowed(from, to) {
+  return downloadtransitions[from].includes(to);
+}
+function advancedownload(record2, state, at, evidence) {
+  if (!transitionallowed(record2.state, state)) return record2;
+  return {
+    ...record2,
+    state,
+    ...evidence?.path !== void 0 ? { path: evidence.path } : record2.path !== void 0 ? { path: record2.path } : {},
+    ...evidence?.bytes !== void 0 ? { bytes: evidence.bytes } : record2.bytes !== void 0 ? { bytes: record2.bytes } : {},
+    ...evidence?.checksum !== void 0 ? { checksum: evidence.checksum } : record2.checksum !== void 0 ? { checksum: record2.checksum } : {},
+    ...evidence?.downloadid !== void 0 ? { downloadid: evidence.downloadid } : record2.downloadid !== void 0 ? { downloadid: record2.downloadid } : {},
+    updatedat: at
+  };
+}
+function concurrentwindow(running, ceiling) {
+  return ceiling === void 0 || running < ceiling;
+}
+function conflictfree(filename, taken) {
+  if (!taken.includes(filename)) return filename;
+  const dot = filename.lastIndexOf(".");
+  const base = dot > 0 ? filename.slice(0, dot) : filename;
+  const extension = dot > 0 ? filename.slice(dot) : "";
+  let sequence = 2;
+  while (taken.includes(`${base}-${sequence}${extension}`)) sequence += 1;
+  return `${base}-${sequence}${extension}`;
+}
+function downloadfilename(url, rule) {
+  if (rule && rule.trim()) return rule.trim();
+  let name = "";
+  try {
+    const parsed = new URL(url);
+    name = decodeURIComponent(parsed.pathname.split("/").filter(Boolean).pop() ?? parsed.hostname);
+  } catch {
+    name = url;
+  }
+  return name || "download";
+}
+function verifybytes(record2, expected) {
+  const statematch = record2.state === "complete";
+  const sizematch = expected.bytes === void 0 ? true : record2.bytes === expected.bytes;
+  const checksummatch = expected.checksum === void 0 ? true : record2.checksum === expected.checksum;
+  const ok = statematch && sizematch && checksummatch;
+  const parts = [`state ${record2.state}${statematch ? " matches" : " does not match the completed expectation"}`];
+  if (expected.bytes !== void 0) parts.push(`size ${record2.bytes ?? "unknown"} of ${expected.bytes} bytes ${sizematch ? "matches" : "differs"}`);
+  if (expected.checksum !== void 0) parts.push(`checksum ${record2.checksum ?? "unknown"} ${checksummatch ? "matches" : "differs from"} the reviewed ${expected.checksum}`);
+  return { ok, summary: `${ok ? "Verified" : "Failed to verify"} the download of ${record2.filename}: ${parts.join("; ")}.`, matches: { state: statematch, size: sizematch, checksum: checksummatch } };
+}
+function mimepatternmatches(pattern, mime) {
+  if (!pattern.endsWith("*")) return pattern === mime;
+  return mime.startsWith(pattern.slice(0, -1));
+}
+function mimeallowed(filter, mime) {
+  if (filter.exclude.some((pattern) => mimepatternmatches(pattern, mime))) return false;
+  if (filter.include.some((pattern) => mimepatternmatches(pattern, mime))) return true;
+  return filter.default === "allow";
+}
+function redactheaders(headers) {
+  return Object.fromEntries(Object.entries(headers).map(([name]) => [name, "[redacted]"]));
+}
+function netlogentry(input) {
+  return { url: input.url, method: input.method, status: input.status, timing: input.timing, requestid: input.requestid, stepid: input.stepid, at: input.at };
+}
+function netlogforstep(records, stepid) {
+  return records.filter((record2) => record2.stepid === stepid);
+}
+function clipentryof(kind, payload, origin, stepid, at) {
+  return { kind, hash: payload.hash, length: payload.length, origin, stepid, at };
+}
+function cliphash(payload) {
+  return checksum(payload);
+}
+function quarantinedpath(filename) {
+  return `devthink-quarantine/${filename.replace(/^\/+/, "")}`;
+}
+function newquarantine(id, filename, reason, at) {
+  const path = quarantinedpath(filename);
+  return { id, path, reason, scan: "pending", at, updatedat: at };
+}
+function scanresult(entry, verdict, at) {
+  return { ...entry, scan: verdict, updatedat: at };
+}
+function scanverdictof(response) {
+  if (!response || typeof response !== "object") return "pending";
+  const verdict = response.verdict;
+  if (verdict === "clean" || verdict === "flagged" || verdict === "error") return verdict;
+  return "pending";
+}
+function released(entry, ref, at) {
+  return { ...entry, release: ref, updatedat: at };
+}
+function capturepart(value) {
+  return value.replace(/[^a-z0-9-]+/gi, "-").replace(/^-+|-+$/g, "").toLowerCase() || "capture";
+}
+function capturefilename(name, extension) {
+  const safeextension = extension.replace(/^\.+/, "").toLowerCase() || "png";
+  return `${capturepart(name.task)}-${capturepart(name.step)}-${name.sequence}.${safeextension}`;
+}
+function advancecounter(counters, base) {
+  const sequence = (counters[base] ?? 0) + 1;
+  return { sequence, counters: { ...counters, [base]: sequence } };
+}
+function capturenames(counters, task, steps, extension) {
+  let current = { ...counters };
+  const names = steps.map((step) => {
+    const advanced = advancecounter(current, step);
+    current = advanced.counters;
+    return capturefilename({ task, step, sequence: advanced.sequence }, extension);
+  });
+  return { names, counters: current };
+}
+function referencedartifacts(plan, completed) {
+  if (!plan) return [];
+  return plan.steps.filter((step) => step.kind === "attachfile" && !completed.includes(step.id)).map((step) => step.value ?? "").filter((value) => value.trim().length > 0);
+}
+function sweepplan(entries, rules, now, keeprefs) {
+  const remove = /* @__PURE__ */ new Set();
+  for (const rule of rules) {
+    const matching = entries.filter((entry) => rule.kind === "any" || entry.kind === rule.kind);
+    const aged = matching.filter((entry) => now - entry.at >= rule.age);
+    const kept = [];
+    if (rule.keep === "all") kept.push(...aged);
+    else if (rule.keep === "latest") {
+      const newest = [...aged].sort((left, right) => right.at - left.at)[0];
+      if (newest) kept.push(newest);
+    }
+    for (const entry of aged) {
+      if (kept.some((item) => item.id === entry.id)) continue;
+      if (keeprefs.includes(entry.id) || keeprefs.includes(entry.name)) continue;
+      remove.add(entry.id);
+    }
+  }
+  return { remove: [...remove], keep: entries.filter((entry) => !remove.has(entry.id)).map((entry) => entry.id) };
+}
+function capturesteps(options, plan) {
+  const listed = Array.isArray(options.steps) ? options.steps.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  return listed.length > 0 ? listed : plan.steps.map((step) => step.id);
+}
+
 // extension/background.ts
 var sessionduration = 15 * 60 * 1e3;
 var freshcheckkinds = /* @__PURE__ */ new Set(["focus", "inspect", "click", "type", "scroll", "select", "hover"]);
@@ -2881,6 +3256,14 @@ function stepauditkind(step, ok) {
   if (step.kind === "submitform" || step.kind === "asksubmit") return "submit";
   if (step.kind === "consentpassword") return "consent";
   if (step.kind === "handoffcaptcha") return "handoff";
+  if (isfileskind(step.kind)) {
+    if (step.kind === "interceptmime") return "intercept";
+    if (step.kind === "readclipboard" || step.kind === "writeclipboard" || step.kind === "copyscreen") return "clipboard";
+    if (step.kind === "quarantinedownload" || step.kind === "scanvirus") return "quarantine";
+    if (step.kind === "cleanupartifacts") return "cleanup";
+    if (step.kind === "verifydownload" || step.kind === "exportnetlog" || step.kind === "namecaptures") return "observation";
+    return "download";
+  }
   if (isdatasetkind(step.kind)) {
     if (step.kind === "exportcsv" || step.kind === "exportjson" || step.kind === "exportexcel" || step.kind === "copytable" || step.kind === "pushsheets") return "export";
     if (step.kind === "streamdisk") return "stream";
@@ -3190,8 +3573,18 @@ async function recordnavigation(step, session, tabid2) {
   await memory.addnavrecord(record2);
   await memory.setnavstate(tabid2, record2);
   if (session && url) await memory.addtrailentry(session.id, { url, title, stepid: step.id, at: Date.now() });
+  await collectnetlog(tabid2, step);
   return record2;
 }
+async function collectnetlog(tabid2, step) {
+  const events = navbuffers.get(tabid2) ?? [];
+  if (events.length === 0) return;
+  const first = events[0]?.timestamp ?? Date.now();
+  for (const [index, event] of events.entries()) {
+    const status = event.status ?? (event.event === "completed" ? 200 : event.event === "error" ? 0 : 0);
+    await memory.addnetlog(netlogentry({ url: event.url, method: "GET", status, timing: Math.max(0, event.timestamp - first), requestid: `${step.id}-${index + 1}`, stepid: step.id, at: event.timestamp }));
+  }
+}
 function injectallowedorigins(step, session) {
   const allowedorigins = session?.grants ?? (session ? [session.origin] : []);
   let options = {};
@@ -4284,6 +4677,270 @@ async function executedatastep(step, session, plan, tabid2, origin) {
       return { ok: false, summary: "Unsupported forms and data step." };
   }
 }
+async function loadownload(reference) {
+  const records = await memory.getdownloads();
+  return records.find((item) => item.id === reference || item.filename === reference || item.url === reference);
+}
+async function settlesdownload(record2) {
+  const started = Date.now();
+  for (; ; ) {
+    const items = record2.downloadid === void 0 ? [] : await chrome.downloads.search({ id: record2.downloadid }).catch(() => []);
+    const item = items[0];
+    if (item?.state === "complete") return { state: "complete", evidence: { path: item.filename, bytes: item.fileSize ?? item.totalBytes ?? 0 } };
+    if (item?.state === "interrupted") return { state: "failed" };
+    if (Date.now() - started >= evidencesettle) return { state: "running" };
+    await new Promise((resolve) => setTimeout(resolve, evidencepoll));
+  }
+}
+async function pauseonerecord(record2, extra) {
+  if (!transitionallowed(record2.state, "paused")) throw new Error(`A ${record2.state} download cannot pause.`);
+  if (record2.downloadid !== void 0) await chrome.downloads.pause(record2.downloadid).catch(() => void 0);
+  const paused = advancedownload(record2, "paused", Date.now());
+  await memory.setdownload(paused);
+  await audit("download", `Paused the download of ${record2.filename} from ${record2.url}.`, extra);
+  return { ok: true, summary: `Paused the download of ${record2.filename}.`, details: { download: paused } };
+}
+async function resumeonerecord(record2, extra) {
+  if (!transitionallowed(record2.state, "running")) throw new Error(`A ${record2.state} download cannot resume.`);
+  if (record2.downloadid !== void 0) await chrome.downloads.resume(record2.downloadid).catch(() => void 0);
+  const resumed = advancedownload(record2, "running", Date.now());
+  await memory.setdownload(resumed);
+  await audit("download", `Resumed the paused download of ${record2.filename} from ${record2.url}.`, extra);
+  return { ok: true, summary: `Resumed the download of ${record2.filename}.`, details: { download: resumed } };
+}
+async function verifyonerecord(record2, expected, extra) {
+  const verification = verifybytes(record2, expected);
+  await audit("observation", `Verified the download of ${record2.filename}: ${verification.summary}`, extra);
+  return { ok: verification.ok, summary: verification.summary, details: { verification: { ...verification.matches, state: record2.state, path: record2.path, checksum: record2.checksum, bytes: record2.bytes } } };
+}
+async function executefilesstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  switch (step.kind) {
+    case "batchdownload": {
+      const spec = options.downloadspec;
+      const urls = Array.isArray(spec?.urls) ? (spec?.urls).filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+      const concurrent = typeof options.concurrent === "number" && Number.isInteger(options.concurrent) && options.concurrent > 0 ? options.concurrent : void 0;
+      const taken = (await memory.getdownloads()).map((record2) => record2.filename);
+      const records = urls.map((url) => {
+        const filename = conflictfree(downloadfilename(url, spec?.filename), taken);
+        taken.push(filename);
+        return { id: randomid(), url, filename, state: "queued", at: Date.now(), updatedat: Date.now() };
+      });
+      let completed = 0;
+      let failed = 0;
+      let queued = 0;
+      let index = 0;
+      while (index < records.length) {
+        const wave = [];
+        while (index < records.length && concurrentwindow(wave.length, concurrent)) {
+          const record2 = records[index];
+          index += 1;
+          const downloadid = await chrome.downloads.download({ url: record2.url, filename: record2.filename }).catch(() => void 0);
+          const started = downloadid === void 0 ? advancedownload(record2, "failed", Date.now()) : advancedownload(record2, "running", Date.now(), { downloadid });
+          await memory.setdownload(started);
+          wave.push(started);
+        }
+        for (const started of wave) {
+          if (started.state === "failed") {
+            failed += 1;
+            continue;
+          }
+          const settled = await settlesdownload(started);
+          const final = advancedownload(started, settled.state, Date.now(), settled.evidence);
+          await memory.setdownload(final);
+          if (final.state === "complete") completed += 1;
+          else if (final.state === "failed") failed += 1;
+          else queued += 1;
+          await memory.setprogress(recorddownload(await memory.getprogress(), plan.id, step.id, { index: records.indexOf(started), url: started.url, state: final.state }, Date.now()));
+        }
+      }
+      await refreshbadge();
+      await audit("download", `Batch downloaded ${records.length} reviewed file${records.length === 1 ? "" : "s"}${concurrent !== void 0 ? ` under the user configured concurrent window of ${concurrent}` : ""}: ${completed} completed, ${failed} failed${queued > 0 ? `, ${queued} still running` : ""}.`, extra);
+      return { ok: failed === 0, summary: `Batch downloaded ${records.length} file${records.length === 1 ? "" : "s"}: ${completed} completed, ${failed} failed${queued > 0 ? `, ${queued} still running` : ""}.`, details: { downloads: records, completed, failed, running: queued, total: records.length, share: downloadshare(completed, records.length), concurrent } };
+    }
+    case "pausedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return pauseonerecord(record2, extra);
+    }
+    case "resumedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return resumeonerecord(record2, extra);
+    }
+    case "verifydownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return verifyonerecord(record2, { ...typeof options.bytes === "number" ? { bytes: options.bytes } : {}, ...typeof options.checksum === "string" ? { checksum: options.checksum } : {} }, extra);
+    }
+    case "interceptmime": {
+      const filter = options.mimefilter;
+      if (!filter) throw new Error("A reviewed mimefilter is required in options.");
+      const filters = await memory.getmimefilters();
+      await memory.setmimefilters([filter, ...filters]);
+      armedmimefilter = filter;
+      installmimelistener();
+      await audit("intercept", `Armed the reviewed mime interception filter: include ${filter.include.join(", ")}, exclude ${filter.exclude.join(", ") || "none"} and the ${filter.default} default for unlisted mime types; matching downloads reroute into quarantine.`, extra);
+      return { ok: true, summary: `Armed the mime interception filter with the ${filter.default} default for unlisted mime types.`, details: { mimefilter: filter } };
+    }
+    case "exportnetlog": {
+      const records = await memory.getnetlog();
+      const stepfilter = typeof options.stepid === "string" && options.stepid ? options.stepid : void 0;
+      const filtered = (stepfilter ? netlogforstep(records, stepfilter) : records).map((record2) => ({ ...record2, headers: redactheaders(record2.headers ?? {}) }));
+      await audit("observation", `Exported ${filtered.length} netlog record${filtered.length === 1 ? "" : "s"} of the run${stepfilter ? ` correlated with step ${stepfilter}` : ""} with every header value redacted.`, extra);
+      return { ok: true, summary: `Exported ${filtered.length} netlog record${filtered.length === 1 ? "" : "s"} with header values redacted.`, details: { netlog: filtered, count: filtered.length, redacted: true, redaction: "every header value is redacted from exported netlogs" } };
+    }
+    case "readclipboard": {
+      const consentref = typeof options.consentref === "string" ? options.consentref : "";
+      const consents = await memory.getclipconsents();
+      const consent = consents.find((item) => item.id === consentref && item.approved === true && item.usedat === void 0);
+      if (!consent) {
+        const pending = { id: consentref || randomid(), prompt: typeof options.prompt === "string" && options.prompt ? options.prompt : step.summary, origin, stepid: step.id, at: Date.now() };
+        await memory.setclipconsent(pending);
+        await refreshbadge();
+        await audit("clipboard", `Clipboard read consent prompt ${pending.id} opened for step ${step.id} on ${origin}; the read waits for the user approval and every read needs its own prompt.`, extra);
+        return { ok: false, summary: `The clipboard read waits for your consent approval${consentref ? ` under ref ${consentref}` : ""}; approve it in the review panel and run the step again.`, details: { consent: { id: pending.id, prompt: pending.prompt, origin, stepid: step.id, approved: false } } };
+      }
+      const text2 = await navigator.clipboard.readText();
+      const entry = clipentryof("read", { hash: cliphash(text2), length: text2.length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await memory.setclipconsent({ ...consent, usedat: Date.now() });
+      await refreshbadge();
+      await audit("clipboard", `Read ${entry.length} clipboard character${entry.length === 1 ? "" : "s"} on the approved consent ${consent.id} with payload hash ${entry.hash}; the payload text never appears in logs or memory.`, extra);
+      return { ok: true, summary: `Read ${entry.length} clipboard character${entry.length === 1 ? "" : "s"} on the approved consent ${consent.id} with payload hash ${entry.hash}.`, details: { clip: entry, masked: maskclipboard(text2) } };
+    }
+    case "writeclipboard": {
+      const output = await dispatchpagestep(step, tabid2, origin, plan);
+      const hash = typeof output?.details?.hash === "string" ? output.details.hash : cliphash(step.value ?? "");
+      const length = typeof output?.details?.length === "number" ? output.details.length : (step.value ?? "").length;
+      const entry = clipentryof("write", { hash, length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await audit("clipboard", `Wrote ${length} reviewed character${length === 1 ? "" : "s"} to the clipboard with payload hash ${hash}; the payload text never appears in logs or memory.`, extra);
+      return { ok: Boolean(output?.ok), summary: output?.summary ?? "The clipboard write returned no result.", details: { ...output?.details ?? {}, clip: entry } };
+    }
+    case "copyscreen": {
+      const windowid = chrome.windows.WINDOW_ID_CURRENT;
+      const shot = await chrome.tabs.captureVisibleTab(windowid, { format: "png" });
+      let destination = "clipboard";
+      try {
+        const blob = await (await fetch(shot)).blob();
+        await navigator.clipboard.write([new ClipboardItem({ "image/png": blob })]);
+      } catch {
+        destination = "clipboard unavailable";
+      }
+      const entry = clipentryof("screen", { hash: cliphash(shot), length: shot.length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await audit("clipboard", `Copied a screenshot of the visible tab (${entry.length} characters of png data) to the clipboard with payload hash ${entry.hash}; destination ${destination}.`, extra);
+      return { ok: destination === "clipboard", summary: `Copied the visible tab screenshot with payload hash ${entry.hash} to the clipboard.`, details: { clip: entry, destination } };
+    }
+    case "quarantinedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      const reason = typeof options.reason === "string" && options.reason ? options.reason : `moved from ${record2.url} by the reviewed quarantine step`;
+      const entry = newquarantine(randomid(), record2.path ?? record2.filename, reason, Date.now());
+      await memory.setquarantine(entry);
+      await refreshbadge();
+      await audit("quarantine", `Quarantined the download ${record2.filename} outside the downloads folder at ${entry.path} with reason ${reason}; the file stays there until a clean scan verdict releases it.`, extra);
+      return { ok: true, summary: `Quarantined ${record2.filename} at ${entry.path} with a pending scan verdict.`, details: { quarantine: entry } };
+    }
+    case "scanvirus": {
+      const reference = step.value ?? "";
+      const entry = (await memory.getquarantines()).find((item) => item.id === reference || item.path === reference);
+      if (!entry) throw new Error(`No quarantined file matches ${reference}.`);
+      const scanner = typeof options.scanner === "string" && options.scanner ? options.scanner : void 0;
+      const hooks = await memory.getscanhooks();
+      const hook = scanner ? hooks.find((item) => item.scanner === scanner) : hooks[0];
+      let verdict = "pending";
+      if (hook) {
+        const granted = await chrome.permissions.contains({ origins: [hostpattern(hook.origin)] }).catch(() => false);
+        if (granted) {
+          try {
+            const response = await fetch(hook.endpoint, { method: "POST", headers: { "content-type": "application/json" }, credentials: "omit", body: JSON.stringify({ quarantine: entry.id, path: entry.path, reason: entry.reason }) });
+            verdict = scanverdictof(await response.json().catch(() => void 0));
+          } catch {
+            verdict = "pending";
+          }
+        }
+      }
+      const scanned = scanresult(entry, verdict, Date.now());
+      await memory.setquarantine(scanned);
+      await refreshbadge();
+      await audit("quarantine", `Scan hook ${hook ? hook.scanner : scanner ?? "none configured"} ${hook ? `returned the ${verdict} verdict` : "is not configured or granted; the verdict stays pending"} for the quarantined file ${entry.path}; hook failures never release a file.`, extra);
+      return { ok: true, summary: `Scan verdict ${verdict} recorded for ${entry.path}.`, details: { quarantine: scanned, verdict } };
+    }
+    case "namecaptures": {
+      const task = typeof options.task === "string" && options.task ? options.task : plan.id;
+      const steps = capturesteps(options, plan);
+      const extension = typeof options.extension === "string" && options.extension ? options.extension : "png";
+      const existing = (await memory.getcapturecounters()).find((item) => item.taskid === task);
+      const stamped = capturenames(existing?.counters ?? {}, task, steps, extension);
+      await memory.setcapturecounter({ taskid: task, counters: stamped.counters, at: Date.now() });
+      await audit("observation", `Stamped ${stamped.names.length} consistent capture name${stamped.names.length === 1 ? "" : "s"} for task ${task} from task, step and sequence parts.`, extra);
+      return { ok: true, summary: `Stamped ${stamped.names.length} capture name${stamped.names.length === 1 ? "" : "s"} for task ${task}.`, details: { task, names: stamped.names, counters: stamped.counters } };
+    }
+    case "cleanupartifacts": {
+      const inlinrules = (Array.isArray(options.rules) ? options.rules : []).filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item));
+      const rules = inlinrules.length > 0 ? inlinrules : await memory.getcleanuprules();
+      if (rules.length === 0) throw new Error("No reviewed cleanup rules are present; pass rules in options or store a rule set from the review panel.");
+      if (inlinrules.length > 0) await memory.setcleanuprules(inlinrules);
+      const exportrecords = await memory.getexports();
+      const artifacts = await memory.getartifacts();
+      const inventory = [
+        ...exportrecords.map((artifact) => ({ id: artifact.id, kind: `export-${artifact.kind}`, name: artifact.name, size: artifact.content.length, at: artifact.at })),
+        ...artifacts.map((artifact) => ({ id: artifact.id, kind: artifact.kind, name: artifact.name, size: 0, at: artifact.at }))
+      ];
+      await memory.setinventory(inventory);
+      const progress = await memory.getprogress();
+      const keeprefs = referencedartifacts(plan, progress?.planid === plan.id ? progress.completedsteps : []);
+      const sweep = sweepplan(inventory, rules, Date.now(), keeprefs);
+      let removed = 0;
+      for (const id of sweep.remove) {
+        if (await memory.removeexport(id)) removed += 1;
+        else if (await memory.removeartifact(id)) removed += 1;
+      }
+      const run = { id: randomid(), rules: rules.length, removed, kept: sweep.keep.length, at: Date.now() };
+      await memory.addcleanuprun(run);
+      await refreshbadge();
+      await audit("cleanup", `Cleanup sweep applied ${rules.length} reviewed rule${rules.length === 1 ? "" : "s"} by age and kind: removed ${removed} artifact${removed === 1 ? "" : "s"}, kept ${sweep.keep.length}${keeprefs.length > 0 ? ` while holding every artifact referenced by open review cards` : ""}.`, extra);
+      return { ok: true, summary: `Cleanup sweep removed ${removed} artifact${removed === 1 ? "" : "s"} and kept ${sweep.keep.length} under the reviewed rules.`, details: { run: { id: run.id, rules: run.rules, removed: run.removed, kept: run.kept }, remove: sweep.remove, inventory: inventory.length } };
+    }
+    default:
+      return { ok: false, summary: "Unsupported files, clipboard and downloads step." };
+  }
+}
+var armedmimefilter;
+var mimelistenerinstalled = false;
+function installmimelistener() {
+  if (mimelistenerinstalled || typeof chrome.downloads?.onDeterminingFilename?.addListener !== "function") return;
+  mimelistenerinstalled = true;
+  chrome.downloads.onDeterminingFilename.addListener((item, suggest) => {
+    const filter = armedmimefilter;
+    if (!filter || item.byExtensionId === chrome.runtime.id) {
+      suggest({ filename: item.filename, conflictAction: "uniquify" });
+      return;
+    }
+    const mime = item.mime ?? "";
+    if (mimeallowed(filter, mime)) {
+      suggest({ filename: `devthink-quarantine/${item.filename}`, conflictAction: "uniquify" });
+      void memory.setquarantine(newquarantine(randomid(), item.filename, `mime ${mime || "unknown"} matched the reviewed include patterns`, Date.now())).then(() => audit("intercept", `Intercepted the download of ${item.filename} (${mime || "unknown mime"}) into quarantine under the reviewed mime filter.`, {})).catch(() => void 0);
+      return;
+    }
+    if (filter.default === "deny") {
+      void chrome.downloads.cancel(item.id).catch(() => void 0);
+      void audit("intercept", `Denied the unlisted download of ${item.filename} (${mime || "unknown mime"}) under the deny default of the reviewed mime filter.`, {}).catch(() => void 0);
+    }
+    suggest({ filename: item.filename, conflictAction: "uniquify" });
+  });
+}
+installmimelistener();
+async function reconcilmimefilter() {
+  const filters = await memory.getmimefilters();
+  armedmimefilter = filters[0];
+  installmimelistener();
+}
+reconcilmimefilter().catch(() => {
+});
 async function enforcewindowreview(step, session, plan) {
   const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
   const progress = plan ? await memory.getprogress() : void 0;
@@ -4319,9 +4976,11 @@ async function refreshbadge() {
   const queues = await memory.getnavqueues();
   const badges = await memory.getbadges();
   const prompts = (await memory.gettickets()).filter((ticket) => ticket.approved === void 0).length;
+  const consents = (await memory.getclipconsents()).filter((record2) => record2.approved === void 0).length;
+  const quarantined = (await memory.getquarantines()).filter((entry) => entry.scan === "pending").length;
   const datasets = (await memory.getdatasets()).length;
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + datasets;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -4347,6 +5006,8 @@ async function executestep(stepid) {
     output = await executetabscommand(step, session, plan, tab.id);
   } else if (isdatasetkind(step.kind)) {
     output = await executedatastep(step, session, plan, tab.id, origin);
+  } else if (isfileskind(step.kind)) {
+    output = await executefilesstep(step, session, plan, tab.id, origin);
   } else if (isformkind(step.kind)) {
     output = await executeformstep(step, session, plan, tab.id, origin);
   } else if (isbrowserkind(step.kind)) {
@@ -4451,6 +5112,7 @@ async function grantcapability(permission) {
   if (!["tabs", "downloads", "clipboardRead", "clipboardWrite"].includes(permission)) throw new Error("Unknown capability.");
   const granted = await chrome.permissions.request({ permissions: [permission] });
   if (!granted) throw new Error("The capability grant was declined.");
+  if (permission === "downloads") installmimelistener();
   await audit("capability", `Capability ${permission} granted by the user.`);
   return refreshcapabilities();
 }
@@ -4524,13 +5186,27 @@ async function handlerequest(message, sender) {
       for (const config of sheetendpoints) {
         sheetgrants.push({ ...config, granted: await chrome.permissions.contains({ origins: [hostpattern(config.origin)] }).catch(() => false) });
       }
+      const downloads = await memory.getdownloads();
+      const netlogs = await memory.getnetlog();
+      const clipconsents = await memory.getclipconsents();
+      const clips = await memory.getclips();
+      const quarantines = await memory.getquarantines();
+      const cleanuprules = await memory.getcleanuprules();
+      const cleanupruns = await memory.getcleanupruns();
+      const capturecounters = await memory.getcapturecounters();
+      const inventory = await memory.getinventory();
+      const mimefilters = await memory.getmimefilters();
+      const scanhooks = [];
+      for (const hook of await memory.getscanhooks()) {
+        scanhooks.push({ ...hook, granted: await chrome.permissions.contains({ origins: [hostpattern(hook.origin)] }).catch(() => false) });
+      }
       const clones = clonetabs(tabs);
       const taskgauge = tasktabgauge(tabs.filter((tab) => badges.some((badge) => badge.tabid === tab.tabid)).length, tasktabceiling(await memory.getsettings()));
       const report = await buildtabreport(tabs);
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -4861,6 +5537,81 @@ async function handlerequest(message, sender) {
       return extractionreportValue();
     case "provenance":
       return provenancereportValue();
+    case "downloadreport": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a download report envelope.");
+      return JSON.parse(downloadreport({ downloads: await memory.getdownloads(), plan }));
+    }
+    case "quarantine":
+      return quarantinereport({ entries: await memory.getquarantines() });
+    case "netlog":
+      return netlogreport({ records: await memory.getnetlog() });
+    case "downloadaction": {
+      const inputdownload = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Download actions stay behind the consent gate of an active session.");
+      const record2 = await loadownload(inputdownload.id ?? "");
+      if (!record2) throw new Error(`No stored download matches ${inputdownload.id ?? ""}.`);
+      const extra = { sessionid: session.id };
+      if (inputdownload.action === "pause") return pauseonerecord(record2, extra);
+      if (inputdownload.action === "resume") return resumeonerecord(record2, extra);
+      if (inputdownload.action === "verify") return verifyonerecord(record2, {}, extra);
+      throw new Error("A pause, resume or verify action is required.");
+    }
+    case "approveclipconsent": {
+      const inputconsent = message;
+      const record2 = (await memory.getclipconsents()).find((item) => item.id === inputconsent.id);
+      if (!record2) throw new Error("No clipboard consent prompt matches the requested id.");
+      await memory.setclipconsent({ ...record2, approved: inputconsent.approved !== false });
+      const session = await memory.getsession();
+      await audit("clipboard", `Clipboard consent prompt ${record2.id} for step ${record2.stepid} on ${record2.origin} ${inputconsent.approved !== false ? "approved" : "declined"} by the user; every read consumes its own prompt.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return { id: record2.id, approved: inputconsent.approved !== false };
+    }
+    case "releasequarantine": {
+      const inputquarantine = message;
+      const entry = (await memory.getquarantines()).find((item) => item.id === inputquarantine.id);
+      if (!entry) throw new Error("No quarantined file matches the requested id.");
+      if (entry.release !== void 0) throw new Error(`The quarantined file ${entry.path} was already released.`);
+      const gate = quarantinereleasegranted(entry);
+      if (!gate.allowed) throw new Error(gate.reason);
+      const releasedentry = released(entry, `user-${Date.now()}`, Date.now());
+      await memory.setquarantine(releasedentry);
+      const session = await memory.getsession();
+      await audit("quarantine", `Quarantine release of ${entry.path} approved with the ${entry.scan} scan verdict under ref ${releasedentry.release}; every release is audited with its verdict.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return releasedentry;
+    }
+    case "setcleanuprules": {
+      const inputrules = message;
+      const rules = (Array.isArray(inputrules.rules) ? inputrules.rules : []).filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item));
+      for (const rule of rules) {
+        const gate = validatecleanuprule(rule);
+        if (!gate.allowed) throw new Error(gate.reason);
+      }
+      await memory.setcleanuprules(rules);
+      const session = await memory.getsession();
+      await audit("cleanup", `The review panel stored ${rules.length} reviewed cleanup rule${rules.length === 1 ? "" : "s"} with age windows and keep policies; ages stay user configured with no code ceiling.`, { ...session ? { sessionid: session.id } : {} });
+      return { rules: rules.length };
+    }
+    case "configurescanhook": {
+      const inputhook = message;
+      const config = normalizeendpoint(inputhook.endpoint ?? "");
+      const granted = await chrome.permissions.contains({ origins: [hostpattern(config.origin)] });
+      if (!granted) throw new Error("The scan hook origin has not received optional permission.");
+      if (!inputhook.scanner?.trim()) throw new Error("A scanner name is required for the scan hook.");
+      const hook = { scanner: inputhook.scanner.trim(), endpoint: config.endpoint, origin: config.origin, configuredat: Date.now() };
+      await memory.setscanhook(hook);
+      await audit("quarantine", `Configured the virus scanning hook ${hook.scanner} at ${hook.origin}; scan verdicts arrive from the endpoint and hook failures stay pending verdicts.`, {});
+      return hook;
+    }
+    case "exportnetlog": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Netlog exports stay behind the consent gate of an active session.");
+      const records = (await memory.getnetlog()).map((record2) => ({ ...record2, headers: redactheaders(record2.headers ?? {}) }));
+      await audit("observation", `The review panel exported ${records.length} netlog record${records.length === 1 ? "" : "s"} of the run with every header value redacted.`, { sessionid: session.id });
+      return { records, redacted: true, redaction: "every header value is redacted from exported netlogs" };
+    }
     case "stop": {
       const session = await memory.getsession();
       if (session) await memory.setsession({ ...session, stoppedat: Date.now() });