@wenathlan/extension 1.1.41 → 1.1.43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,5 +1,5 @@
1
1
  <!doctype html>
2
2
  <html lang="en">
3
3
  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Devthink review</title><link rel="stylesheet" href="style.css"></head>
4
- <body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Navigation trail</h2><ol id="trail" class="audit"></ol></section><section><h2>Navigation state</h2><div id="navigation" class="panel"></div></section><section><h2>Tabs and windows</h2><div id="tabswindows" class="panel"></div></section><section><h2>Forms and data</h2><div id="forms" class="panel"></div></section><section><h2>Files and downloads</h2><div id="files" class="panel"></div></section><section><h2>Capture gallery</h2><div id="captures" class="panel"></div></section><section><h2>Media</h2><div id="media" class="panel"></div></section><section><h2>Datasets</h2><div id="datasets" class="panel"></div></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
4
+ <body><main class="wide"><header><p class="eyebrow">REVIEW GATE</p><h1>Plan before action</h1><p>Every browser operation remains blocked until the user reviews and approves it here.</p></header><label for="objective">Objective</label><textarea id="objective" rows="4" placeholder="Describe a browser task to turn into a reviewable plan."></textarea><div class="actions"><button id="localplan">Create local observation plan</button><button id="remoteplan" class="secondary">Ask configured endpoint</button><button id="diagnostic" class="secondary">Capture local diagnostics</button></div><p id="status" role="status">Loading session state.</p><p id="capabilitiestext" role="status" class="muted">Optional capabilities unknown.</p><section><h2>Current plan</h2><progress id="planprogress" max="1" value="0"></progress><div id="plan" class="panel"></div></section><section><h2>Clickable map</h2><ol id="map" class="audit maplist"></ol></section><section><h2>Navigation trail</h2><ol id="trail" class="audit"></ol></section><section><h2>Navigation state</h2><div id="navigation" class="panel"></div></section><section><h2>Tabs and windows</h2><div id="tabswindows" class="panel"></div></section><section><h2>Forms and data</h2><div id="forms" class="panel"></div></section><section><h2>Files and downloads</h2><div id="files" class="panel"></div></section><section><h2>Capture gallery</h2><div id="captures" class="panel"></div></section><section><h2>Media</h2><div id="media" class="panel"></div></section><section><h2>Network calls</h2><div id="calls" class="panel"></div></section><section><h2>Network view</h2><div id="netview" class="panel"></div></section><section><h2>Datasets</h2><div id="datasets" class="panel"></div></section><section><h2>Consent banners</h2><div id="banners" class="panel"></div></section><section><h2>Accessibility tree</h2><div id="a11y" class="panel"></div></section><section><h2>Reader view</h2><div id="reader" class="panel"></div></section><section><h2>Detected shapes</h2><ol id="detections" class="audit maplist"></ol></section><section><h2>Watch stream</h2><ol id="stream" class="audit"></ol></section><section><h2>Snapshot diffs</h2><div id="diffs" class="panel"></div></section><section><h2>Derived selectors</h2><ol id="selectors" class="audit maplist"></ol></section><section><h2>Structured diagnostics</h2><ul id="diagnostics" class="audit"></ul></section><section><h2>Local audit</h2><ol id="audit" class="audit"></ol></section></main><script type="module" src="sidepanel.js"></script></body>
5
5
  </html>
@@ -1,7 +1,7 @@
1
1
  // policy.ts
2
- var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages"]);
3
- var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
4
- var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs"]);
2
+ var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage"]);
3
+ var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies"]);
4
+ var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi"]);
5
5
  var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
6
6
 
7
7
  // extension/tabscommand.ts
@@ -65,6 +65,8 @@ var datasetsroot = document.querySelector("#datasets");
65
65
  var filesroot = document.querySelector("#files");
66
66
  var capturesroot = document.querySelector("#captures");
67
67
  var mediaroot = document.querySelector("#media");
68
+ var callsroot = document.querySelector("#calls");
69
+ var netviewroot = document.querySelector("#netview");
68
70
  var statusnode = document.querySelector("#status");
69
71
  var progressnode = document.querySelector("#planprogress");
70
72
  var capabilitiestext = document.querySelector("#capabilitiestext");
@@ -1687,6 +1689,280 @@ function rendercaptures(context) {
1687
1689
  capturesroot.append(card);
1688
1690
  }
1689
1691
  }
1692
+ function rendercalls(context) {
1693
+ if (!callsroot) return;
1694
+ callsroot.replaceChildren();
1695
+ const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
1696
+ for (const consent of (context.fetchconsents ?? []).filter((item) => item.approved === void 0)) {
1697
+ const card = document.createElement("div");
1698
+ card.className = "panel consentcard";
1699
+ const head = document.createElement("p");
1700
+ head.textContent = `Fetch consent ${consent.id} for ${consent.origin}: review every custom header before it is sent.`;
1701
+ card.append(head);
1702
+ for (const header of consent.headers) {
1703
+ const row = document.createElement("p");
1704
+ row.textContent = `${header.name}: ${header.value}`;
1705
+ card.append(row);
1706
+ }
1707
+ const note = document.createElement("p");
1708
+ note.className = "muted";
1709
+ note.textContent = `The prompt appears once per origin and expires ${new Date(consent.expiresat).toLocaleTimeString()}; header values never enter the audit trail.`;
1710
+ card.append(note);
1711
+ const actions2 = document.createElement("div");
1712
+ actions2.className = "actions";
1713
+ actions2.append(button("Approve headers", () => request({ kind: "approvefetchconsent", id: consent.id, approved: true }).then(() => status(`Fetch consent ${consent.id} approved; rerun the fetch step.`)).then(refresh)));
1714
+ actions2.append(button("Decline", () => request({ kind: "approvefetchconsent", id: consent.id, approved: false }).then(() => status(`Fetch consent ${consent.id} declined.`)).then(refresh)));
1715
+ card.append(actions2);
1716
+ callsroot.append(card);
1717
+ }
1718
+ const endpoints = context.endpoints ?? [];
1719
+ if (endpoints.length > 0) {
1720
+ const card = document.createElement("div");
1721
+ card.className = "panel";
1722
+ const head = document.createElement("p");
1723
+ head.textContent = `typed endpoints: ${endpoints.length}`;
1724
+ card.append(head);
1725
+ for (const endpoint of endpoints) {
1726
+ const row = document.createElement("p");
1727
+ row.textContent = `${endpoint.name} \xB7 ${endpoint.method} ${endpoint.url} \xB7 v${endpoint.version} \xB7 ${endpoint.schema?.fields.length ?? 0} payload field${endpoint.schema?.fields.length === 1 ? "" : "s"}${endpoint.headers !== void 0 ? ` \xB7 ${Object.keys(endpoint.headers).length} reviewed header${Object.keys(endpoint.headers).length === 1 ? "" : "s"}` : ""}`;
1728
+ card.append(row);
1729
+ }
1730
+ callsroot.append(card);
1731
+ }
1732
+ const apikeys = context.apikeys ?? [];
1733
+ if (apikeys.length > 0) {
1734
+ const card = document.createElement("div");
1735
+ card.className = "panel";
1736
+ const head = document.createElement("p");
1737
+ head.textContent = `api key references: ${apikeys.length} (secrets never listed)`;
1738
+ card.append(head);
1739
+ for (const ref of apikeys) {
1740
+ const row = document.createElement("p");
1741
+ row.textContent = `${ref.name} \xB7 header ${ref.header} \xB7 scoped to ${ref.origins.join(", ")}`;
1742
+ card.append(row);
1743
+ const actions2 = document.createElement("div");
1744
+ actions2.className = "actions";
1745
+ actions2.append(button(`Remove ${ref.name}`, () => request({ kind: "deleteapikey", name: ref.name }).then(() => status(`Api key reference ${ref.name} removed.`)).then(refresh)));
1746
+ card.append(actions2);
1747
+ }
1748
+ callsroot.append(card);
1749
+ }
1750
+ const callsmeta = context.calls ?? [];
1751
+ const filters = document.createElement("div");
1752
+ filters.className = "actions";
1753
+ const originfilter = document.createElement("input");
1754
+ originfilter.placeholder = "filter by origin";
1755
+ const methodfilter = document.createElement("input");
1756
+ methodfilter.placeholder = "filter by method";
1757
+ const classfilter = document.createElement("input");
1758
+ classfilter.placeholder = "filter by status class";
1759
+ filters.append(originfilter, methodfilter, classfilter);
1760
+ callsroot.append(filters);
1761
+ const list = document.createElement("div");
1762
+ const applyfilters = () => {
1763
+ list.replaceChildren();
1764
+ const origin = originfilter.value.trim().toLowerCase();
1765
+ const method = methodfilter.value.trim().toUpperCase();
1766
+ const statusclass = classfilter.value.trim().toLowerCase();
1767
+ const matched = callsmeta.filter((call) => (!origin || call.origin.toLowerCase().includes(origin)) && (!method || call.method.toUpperCase().includes(method)) && (!statusclass || call.statusclass.includes(statusclass)));
1768
+ if (matched.length === 0) {
1769
+ list.textContent = "No outbound call matches the filters yet.";
1770
+ return;
1771
+ }
1772
+ for (const call of matched) {
1773
+ const card = document.createElement("details");
1774
+ card.className = "panel callcard";
1775
+ const summary = document.createElement("summary");
1776
+ const credential = call.headernames.some((name) => name.toLowerCase().startsWith("apikey:") || ["authorization", "cookie", "proxy-authorization", "api-key", "x-api-key", "x-auth-token"].includes(name.toLowerCase()));
1777
+ summary.textContent = `${call.method} ${call.kind} ${call.status} ${call.statusclass} \xB7 ${new URL(call.url).host} \xB7 ${call.duration} ms \xB7 ${call.retries} retr${call.retries === 1 ? "y" : "ies"} \xB7 ${call.bytes} bytes \xB7 step ${call.stepid}`;
1778
+ if (credential) {
1779
+ const badge = document.createElement("span");
1780
+ badge.className = "credentialbadge";
1781
+ badge.textContent = " credential call ";
1782
+ summary.append(badge);
1783
+ }
1784
+ card.append(summary);
1785
+ const urlrow = document.createElement("p");
1786
+ urlrow.textContent = `url: ${call.url}${call.endpoint !== void 0 ? ` \xB7 endpoint ${call.endpoint}` : ""}${call.bodyexpired === true ? " \xB7 body expired from retention" : ""}`;
1787
+ card.append(urlrow);
1788
+ const headersrow = document.createElement("p");
1789
+ headersrow.textContent = `request header names: ${call.headernames.length > 0 ? call.headernames.join(", ") : "none"} (values never persist)`;
1790
+ card.append(headersrow);
1791
+ if ((call.fields ?? []).length > 0) {
1792
+ const fieldstitle = document.createElement("p");
1793
+ fieldstitle.textContent = `parsed fields: ${(call.fields ?? []).length}`;
1794
+ card.append(fieldstitle);
1795
+ for (const field of call.fields ?? []) {
1796
+ const fieldrow = document.createElement("p");
1797
+ fieldrow.textContent = `${field.name} (${field.kind}) from ${field.path}: ${field.missing === true ? "miss filled by the reviewed default" : JSON.stringify(field.value)}`;
1798
+ card.append(fieldrow);
1799
+ }
1800
+ }
1801
+ if (call.streambytes !== void 0) {
1802
+ const streamrow = document.createElement("p");
1803
+ streamrow.textContent = `streamed ${call.streambytes} bytes of the response body`;
1804
+ card.append(streamrow);
1805
+ const gauge = document.createElement("progress");
1806
+ gauge.max = Math.max(call.streambytes, call.bytes);
1807
+ gauge.value = call.streambytes;
1808
+ card.append(gauge);
1809
+ }
1810
+ for (const error of call.errors ?? []) {
1811
+ const errorrow = document.createElement("p");
1812
+ errorrow.className = "diffrow.removed";
1813
+ errorrow.textContent = `error of step ${call.stepid}: ${error}`;
1814
+ card.append(errorrow);
1815
+ }
1816
+ list.append(card);
1817
+ }
1818
+ };
1819
+ originfilter.addEventListener("input", applyfilters);
1820
+ methodfilter.addEventListener("input", applyfilters);
1821
+ classfilter.addEventListener("input", applyfilters);
1822
+ applyfilters();
1823
+ callsroot.append(list);
1824
+ const actions = document.createElement("div");
1825
+ actions.className = "actions";
1826
+ actions.append(button(`Export ${callsmeta.length} call${callsmeta.length === 1 ? "" : "s"}`, () => request({ kind: "exportcalls" }).then(() => status(`Exported ${callsmeta.length} call record${callsmeta.length === 1 ? "" : "s"} through the reviewed download flow.`)).catch((error) => status(error instanceof Error ? error.message : String(error), true))));
1827
+ if (active) {
1828
+ const retentioninput = document.createElement("input");
1829
+ retentioninput.placeholder = "call body retention (records)";
1830
+ retentioninput.value = context.callretention !== void 0 ? String(context.callretention) : "";
1831
+ retentioninput.setAttribute("aria-label", "call body retention window");
1832
+ const retentionbutton = button("Save call retention", () => request({ kind: "setcallretention", retention: retentioninput.value === "" ? void 0 : Number(retentioninput.value) }).then(() => status(`Call body retention saved as ${retentioninput.value === "" ? "keep every body" : retentioninput.value} records; metadata always survives.`)).then(refresh));
1833
+ actions.append(retentioninput, retentionbutton);
1834
+ }
1835
+ callsroot.append(actions);
1836
+ }
1837
+ function rendernetview(context) {
1838
+ if (!netviewroot) return;
1839
+ netviewroot.replaceChildren();
1840
+ const active = context.session && !context.session.stoppedat && context.session.expiresat > Date.now();
1841
+ const grantcard = document.createElement("div");
1842
+ grantcard.className = "panel";
1843
+ const grantrow = document.createElement("p");
1844
+ grantrow.textContent = `request watching: ${context.webrequestgrant === true ? "granted" : "not granted"} \u2014 the observation derives from the page timing buffers and adds no manifest permission.`;
1845
+ grantcard.append(grantrow);
1846
+ if (active) {
1847
+ const grantactions = document.createElement("div");
1848
+ grantactions.className = "actions";
1849
+ grantactions.append(button(context.webrequestgrant === true ? "Revoke request watching" : "Grant request watching", () => request({ kind: "setwebrequestgrant", granted: context.webrequestgrant !== true }).then(() => status(context.webrequestgrant === true ? "Request watching revoked." : "Request watching granted; watchrequests steps can run now.")).then(refresh)));
1850
+ grantcard.append(grantactions);
1851
+ }
1852
+ netviewroot.append(grantcard);
1853
+ const channels = context.channels ?? [];
1854
+ const subscriptions = context.subscriptions ?? [];
1855
+ if (channels.length > 0 || subscriptions.length > 0 || (context.socketsactive ?? 0) > 0) {
1856
+ const card = document.createElement("div");
1857
+ card.className = "panel";
1858
+ const head = document.createElement("p");
1859
+ head.textContent = `live channels: ${channels.length} websocket channel${channels.length === 1 ? "" : "s"} \xB7 ${subscriptions.length} event stream${subscriptions.length === 1 ? "" : "s"}`;
1860
+ card.append(head);
1861
+ for (const channel of channels) {
1862
+ const row = document.createElement("p");
1863
+ row.textContent = `${channel.kind} ${channel.state} \xB7 ${channel.origin} \xB7 ${channel.sent} sent \xB7 ${channel.received} received \xB7 ${channel.reconnects} reconnect${channel.reconnects === 1 ? "" : "s"}${channel.lasteventid !== void 0 ? ` \xB7 last event ${channel.lasteventid}` : ""}`;
1864
+ card.append(row);
1865
+ if (channel.state === "open" || channel.state === "connecting") {
1866
+ const actions2 = document.createElement("div");
1867
+ actions2.className = "actions";
1868
+ actions2.append(button(`Close ${channel.id}`, () => request({ kind: "closesocket", id: channel.id }).then(() => status(`Channel ${channel.id} closed cleanly.`)).then(refresh)));
1869
+ card.append(actions2);
1870
+ }
1871
+ }
1872
+ for (const subscription of subscriptions) {
1873
+ const row = document.createElement("p");
1874
+ row.textContent = `sse ${subscription.state} \xB7 ${subscription.origin} \xB7 ${subscription.events} event${subscription.events === 1 ? "" : "s"}${subscription.names.length > 0 ? ` (${subscription.names.slice(0, 4).join(", ")}${subscription.names.length > 4 ? "\u2026" : ""})` : ""}${subscription.lasteventid !== void 0 ? ` \xB7 resume at ${subscription.lasteventid}` : ""} \xB7 cancel on ${subscription.cancel.kind}`;
1875
+ card.append(row);
1876
+ }
1877
+ netviewroot.append(card);
1878
+ }
1879
+ const pollevidence = (context.progress?.outcomes ?? []).filter((outcome) => outcome.details?.poll !== void 0).map((outcome) => outcome.details?.poll);
1880
+ if (pollevidence.length > 0) {
1881
+ const card = document.createElement("div");
1882
+ card.className = "panel";
1883
+ const head = document.createElement("p");
1884
+ head.textContent = `poll loops: ${pollevidence.length} iteration${pollevidence.length === 1 ? "" : "s"}`;
1885
+ card.append(head);
1886
+ for (const poll of pollevidence.slice(0, 8)) {
1887
+ const row = document.createElement("p");
1888
+ row.textContent = `poll ${poll.poll} \xB7 status ${poll.status}${poll.cursor !== void 0 ? ` \xB7 cursor ${poll.cursor}` : ""} \xB7 ${poll.stopped ? `stopped: ${poll.reason}` : "continuing"}`;
1889
+ card.append(row);
1890
+ }
1891
+ card.append(document.createRange().createContextualFragment(""));
1892
+ netviewroot.append(card);
1893
+ }
1894
+ const exchanges = context.exchanges ?? [];
1895
+ const list = document.createElement("div");
1896
+ if (exchanges.length === 0) {
1897
+ list.textContent = "No request of the run has been observed yet; grant request watching and run a watchrequests step.";
1898
+ }
1899
+ for (const exchange of exchanges) {
1900
+ const card = document.createElement("details");
1901
+ card.className = "panel callcard";
1902
+ const summary = document.createElement("summary");
1903
+ summary.textContent = `${exchange.method} ${exchange.status} ${exchange.statusclass} \xB7 ${new URL(exchange.url).host} \xB7 ${exchange.bytes} bytes \xB7 ${exchange.timing} ms \xB7 correlation ${exchange.correlationid} \xB7 ${exchange.source === "page" ? "derived" : "captured"}`;
1904
+ if (exchange.errorclass !== void 0) {
1905
+ const badge = document.createElement("span");
1906
+ badge.className = "credentialbadge";
1907
+ badge.textContent = ` ${exchange.errorclass} `;
1908
+ summary.append(badge);
1909
+ }
1910
+ card.append(summary);
1911
+ const urlrow = document.createElement("p");
1912
+ urlrow.textContent = `url: ${exchange.url}${exchange.mime !== void 0 ? ` \xB7 ${exchange.mime}` : ""}${exchange.bodyref !== void 0 ? ` \xB7 body ${exchange.bodyref}` : ""}${exchange.bodyexpired === true ? " \xB7 body expired from retention" : ""}`;
1913
+ card.append(urlrow);
1914
+ const requestheadernames = Object.keys(exchange.requestheaders ?? {});
1915
+ if (requestheadernames.length > 0 || Object.keys(exchange.responseheaders ?? {}).length > 0) {
1916
+ const headersrow = document.createElement("p");
1917
+ headersrow.textContent = `stored headers (redacted on the redaction list): request ${requestheadernames.length > 0 ? requestheadernames.join(", ") : "none"} \xB7 response ${Object.keys(exchange.responseheaders ?? {}).join(", ") || "none"}`;
1918
+ card.append(headersrow);
1919
+ } else {
1920
+ const headersrow = document.createElement("p");
1921
+ headersrow.className = "muted";
1922
+ headersrow.textContent = "no captured headers: derived page exchanges expose no header names through the timing buffers.";
1923
+ card.append(headersrow);
1924
+ }
1925
+ if (exchange.bodyref !== void 0 && exchange.bodyexpired !== true) {
1926
+ const bodyrow = document.createElement("p");
1927
+ bodyrow.textContent = `captured body ${exchange.bodyref}`;
1928
+ card.append(bodyrow);
1929
+ const actions2 = document.createElement("div");
1930
+ actions2.className = "actions";
1931
+ actions2.append(button(`Preview body ${exchange.bodyref}`, () => request({ kind: "exchangebody", ref: exchange.bodyref }).then((value) => {
1932
+ const record = value;
1933
+ bodyrow.textContent = `captured body ${exchange.bodyref} of ${record.mime} and ${record.bytes} bytes: ${record.body.slice(0, 400)}${record.body.length > 400 ? "\u2026 (display preview truncates; the stored body keeps every byte)" : ""}`;
1934
+ }).catch((error) => status(error instanceof Error ? error.message : String(error), true))));
1935
+ card.append(actions2);
1936
+ }
1937
+ list.append(card);
1938
+ }
1939
+ netviewroot.append(list);
1940
+ const apimap = context.apimap ?? [];
1941
+ if (apimap.length > 0) {
1942
+ const card = document.createElement("div");
1943
+ card.className = "panel";
1944
+ const head = document.createElement("p");
1945
+ head.textContent = `page api map: ${apimap.length} ranked endpoint${apimap.length === 1 ? "" : "s"}`;
1946
+ card.append(head);
1947
+ for (const entry of apimap.slice(0, 10)) {
1948
+ const row = document.createElement("p");
1949
+ row.textContent = `${entry.method} ${entry.endpoint} \xB7 ${entry.frequency} call${entry.frequency === 1 ? "" : "s"} \xB7 json ${Math.round(entry.jsonshare * 100)}% \xB7 stable ${Math.round(entry.stability * 100)}%${entry.payloadshape.length > 0 ? ` \xB7 ${entry.payloadshape.slice(0, 5).join(", ")}` : ""}`;
1950
+ card.append(row);
1951
+ }
1952
+ netviewroot.append(card);
1953
+ }
1954
+ const actions = document.createElement("div");
1955
+ actions.className = "actions";
1956
+ actions.append(button(`Export netlog (${exchanges.length} exchange${exchanges.length === 1 ? "" : "s"})`, () => request({ kind: "exportnetlog" }).then(() => status("Exported the captured run log through the reviewed download flow.")).catch((error) => status(error instanceof Error ? error.message : String(error), true))));
1957
+ if (active) {
1958
+ const retentioninput = document.createElement("input");
1959
+ retentioninput.placeholder = "captured body retention (records)";
1960
+ retentioninput.value = context.bodyretention !== void 0 ? String(context.bodyretention) : "";
1961
+ retentioninput.setAttribute("aria-label", "captured body retention window");
1962
+ actions.append(retentioninput, button("Save body retention", () => request({ kind: "setbodyretention", retention: retentioninput.value === "" ? void 0 : Number(retentioninput.value) }).then(() => status(`Captured body retention saved as ${retentioninput.value === "" ? "keep every body" : retentioninput.value} records; exchange metadata always survives.`)).then(refresh)));
1963
+ }
1964
+ netviewroot.append(actions);
1965
+ }
1690
1966
  function rendercapabilities(report) {
1691
1967
  if (!capabilitiestext) return;
1692
1968
  if (!report) {
@@ -1738,6 +2014,8 @@ async function refresh() {
1738
2014
  renderfiles(context);
1739
2015
  rendercaptures(context);
1740
2016
  rendermedia(context);
2017
+ rendercalls(context);
2018
+ rendernetview(context);
1741
2019
  renderaudit(context.audit);
1742
2020
  rendercapabilities(context.capabilities);
1743
2021
  if (context.session?.pausedat) status("Session paused. Reviewed actions are blocked until resume.");