@wenathlan/extension 1.1.44 → 1.1.46

package/extension/dist/background.js

@@ -1042,6 +1042,205 @@ var sessionmemory = class {
     if (live.length !== records.length) await this.adapter.set("ratelimits", live);
     return live;
   }
+  /** Stores one run timeline entry; the user configured timeline retention window expires the oldest entries while their level counts survive in the per run level summaries. */
+  async addtimelineentry(entry) {
+    const records = await this.gettimeline();
+    const combined = [entry, ...records];
+    const retention = (await this.getsettings())?.timelineretention;
+    if (retention === void 0) {
+      await this.adapter.set("timelineentries", combined);
+      return;
+    }
+    const kept = combined.slice(0, retention);
+    const expired = combined.slice(retention);
+    if (expired.length > 0) {
+      const expiredcounts = /* @__PURE__ */ new Map();
+      for (const item of expired) {
+        const counts = expiredcounts.get(item.runid) ?? {};
+        counts[item.level] = (counts[item.level] ?? 0) + 1;
+        expiredcounts.set(item.runid, counts);
+      }
+      for (const [runid, counts] of expiredcounts) await this.mergelevelsummary(runid, counts, Date.now());
+    }
+    await this.adapter.set("timelineentries", kept);
+  }
+  /** Returns every stored run timeline entry, newest first. */
+  async gettimeline() {
+    return await this.adapter.get("timelineentries") ?? [];
+  }
+  /** Returns the run timeline entries filtered by run, level and step id. */
+  async listtimeline(filter) {
+    const records = await this.gettimeline();
+    return records.filter((item) => (filter.runid === void 0 || item.runid === filter.runid) && (filter.level === void 0 || item.level === filter.level) && (filter.stepid === void 0 || item.stepid === filter.stepid));
+  }
+  /** Stores one captured javascript error record with its stack frames, source url and line. */
+  async adderrorrecord(record2) {
+    const records = await this.adapter.get("errorrecords") ?? [];
+    await this.adapter.set("errorrecords", [record2, ...records]);
+  }
+  /** Returns every stored error record, newest first. */
+  async geterrorrecords() {
+    return await this.adapter.get("errorrecords") ?? [];
+  }
+  /** Stores one captured unhandled rejection record with its reason and stack frames. */
+  async addrejectionrecord(record2) {
+    const records = await this.adapter.get("rejectionrecords") ?? [];
+    await this.adapter.set("rejectionrecords", [record2, ...records]);
+  }
+  /** Returns every stored rejection record, newest first. */
+  async getrejectionrecords() {
+    return await this.adapter.get("rejectionrecords") ?? [];
+  }
+  /** Stores one captured long task entry with its duration, start time and attribution names. */
+  async addlongtask(record2) {
+    const records = await this.adapter.get("longtasks") ?? [];
+    await this.adapter.set("longtasks", [record2, ...records]);
+  }
+  /** Returns every stored long task entry, newest first. */
+  async getlongtasks() {
+    return await this.adapter.get("longtasks") ?? [];
+  }
+  /** Stores one console diff result between two runs, replacing the previous one. */
+  async addconsolediff(diff) {
+    return this.adapter.set("consolediff", diff);
+  }
+  /** Returns the one stored console diff result. */
+  async getdiff() {
+    return this.adapter.get("consolediff");
+  }
+  /** Stores one log rotation target record with its overflow entry counts, replacing the previous record of that target and run. */
+  async addrotationtarget(record2) {
+    const records = (await this.adapter.get("rotationtargets") ?? []).filter((item) => !(item.target === record2.target && item.runid === record2.runid));
+    await this.adapter.set("rotationtargets", [record2, ...records]);
+  }
+  /** Returns every stored rotation target record with its overflow entry counts, newest first. */
+  async getrotationtargets() {
+    return await this.adapter.get("rotationtargets") ?? [];
+  }
+  /** Stores one console capture consent decision per origin; the approved decision persists so console watching on that origin prompts once. */
+  async setconsoleconsent(consent) {
+    const records = (await this.adapter.get("consoleconsents") ?? []).filter((item) => item.id !== consent.id);
+    await this.adapter.set("consoleconsents", [consent, ...records]);
+  }
+  /** Returns every console capture consent decision, newest first. */
+  async getconsoleconsents() {
+    return await this.adapter.get("consoleconsents") ?? [];
+  }
+  /** Stores one devtools session record with its enabled domains and detach state, replacing the previous record of its id. */
+  async setcdpsession(session) {
+    const records = (await this.adapter.get("cdpsessions") ?? []).filter((item) => item.id !== session.id);
+    await this.adapter.set("cdpsessions", [session, ...records]);
+  }
+  /** Returns every stored devtools session record, newest first. */
+  async getcdpsessions() {
+    return await this.adapter.get("cdpsessions") ?? [];
+  }
+  /** Stores one raw command outcome with its duration and error class. */
+  async addcdpcommand(command) {
+    const records = await this.adapter.get("cdpcommands") ?? [];
+    await this.adapter.set("cdpcommands", [command, ...records]);
+  }
+  /** Returns every stored raw command outcome, newest first. */
+  async getcdpcommands() {
+    return await this.adapter.get("cdpcommands") ?? [];
+  }
+  /** Stores one domain event rule with its match filter, replacing the previous rule of its id. */
+  async setcdpeventrule(rule) {
+    const records = (await this.adapter.get("cdpeventrules") ?? []).filter((item) => item.id !== rule.id);
+    await this.adapter.set("cdpeventrules", [rule, ...records]);
+  }
+  /** Returns every stored domain event rule, newest first. */
+  async getcdpeventrules() {
+    return await this.adapter.get("cdpeventrules") ?? [];
+  }
+  /** Stores one breakpoint record with its condition and hit counter, replacing the previous record of its id. */
+  async addbreakpoint(spec) {
+    const records = (await this.adapter.get("breakpoints") ?? []).filter((item) => item.id !== spec.id);
+    await this.adapter.set("breakpoints", [spec, ...records]);
+  }
+  /** Returns every stored breakpoint record, newest first. */
+  async getbreakpoints() {
+    return await this.adapter.get("breakpoints") ?? [];
+  }
+  /** Stores one pause state capture; the user configured pause retention window expires the call frames and the dom snapshot reference of the oldest captures while the pause reason and hit breakpoint survive. */
+  async addpause(pause) {
+    const records = await this.getpauses();
+    const combined = [pause, ...records.filter((item) => item.id !== pause.id)];
+    const retention = (await this.getsettings())?.pauseretention;
+    if (retention === void 0) {
+      await this.adapter.set("pauses", combined);
+      return;
+    }
+    const kept = combined.slice(0, retention);
+    const expired = combined.slice(retention).map((item) => {
+      if (item.framesexpired === true) return item;
+      const faded = { ...item, callframes: [], framesexpired: true };
+      delete faded.domsnapshotid;
+      return faded;
+    });
+    await this.adapter.set("pauses", [...kept, ...expired]);
+  }
+  /** Returns every stored pause state capture, newest first. */
+  async getpauses() {
+    return await this.adapter.get("pauses") ?? [];
+  }
+  /** Returns the pause state captures of one run, newest first. */
+  async listpauses(runid) {
+    const records = await this.getpauses();
+    return records.filter((item) => item.runid === runid);
+  }
+  /** Stores one watch expression with its per pause values, replacing the previous expression of its id. */
+  async setwatchexpression(expression) {
+    const records = (await this.adapter.get("watchexpressions") ?? []).filter((item) => item.id !== expression.id);
+    await this.adapter.set("watchexpressions", [expression, ...records]);
+  }
+  /** Returns every stored watch expression, newest first. */
+  async getwatchexpressions() {
+    return await this.adapter.get("watchexpressions") ?? [];
+  }
+  /** Stores one script override with its review provenance, replacing the previous override of its id. */
+  async addscriptoverride(spec) {
+    const records = (await this.adapter.get("scriptoverrides") ?? []).filter((item) => item.id !== spec.id);
+    await this.adapter.set("scriptoverrides", [spec, ...records]);
+  }
+  /** Returns every stored script override, newest first. */
+  async getscriptoverrides() {
+    return await this.adapter.get("scriptoverrides") ?? [];
+  }
+  /** Stores one debugger consent decision per origin with the consented domain list, replacing the previous decision of its id. */
+  async setdebuggergrant(grant) {
+    const records = (await this.adapter.get("debuggergrants") ?? []).filter((item) => item.id !== grant.id);
+    await this.adapter.set("debuggergrants", [grant, ...records]);
+  }
+  /** Returns every debugger consent decision, newest first. */
+  async getdebuggergrants() {
+    return await this.adapter.get("debuggergrants") ?? [];
+  }
+  /** Revokes every approved debugger consent of one origin: the revoke time stamps the records so the next attach needs a new reviewed prompt. */
+  async revokedebuggergrants(origin, at) {
+    const records = await this.getdebuggergrants();
+    let revoked = 0;
+    const updated = records.map((grant) => {
+      if (grant.origin !== origin || grant.revokedat !== void 0) return grant;
+      revoked += 1;
+      return { ...grant, revokedat: at };
+    });
+    await this.adapter.set("debuggergrants", updated);
+    return revoked;
+  }
+  /** Merges expired entry counts into the per run level count summary that survives the retention window. */
+  async mergelevelsummary(runid, counts, now) {
+    const records = await this.getlevelsummaries();
+    const existing = records.find((item) => item.runid === runid);
+    const merged = { ...existing?.counts ?? {} };
+    for (const [level, count] of Object.entries(counts)) merged[level] = (merged[level] ?? 0) + count;
+    const updated = { runid, counts: merged, at: now };
+    await this.adapter.set("levelsummaries", [updated, ...records.filter((item) => item.runid !== runid)]);
+  }
+  /** Returns every per run level count summary, newest first. */
+  async getlevelsummaries() {
+    return await this.adapter.get("levelsummaries") ?? [];
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -1908,6 +2107,126 @@ function ratelimitwait(state, now) {
   return Math.max(0, state.resetat - now);
 }
 
+// cdpbus.ts
+var cdpkinds = ["attachcdp", "detachcdp", "cdpcmd", "watchcdp", "setbreakpoint", "stepcode", "watchexpr", "overridescript"];
+var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
+function methoddomain(method) {
+  const match = /^([A-Z][A-Za-z]*)\.([a-zA-Z][A-Za-z0-9]*)$/.exec(method.trim());
+  return match?.[1];
+}
+function cdpallowlistof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const domains = Array.isArray(entry.domains) ? entry.domains.filter((domain) => typeof domain === "string" && cdpdomains.includes(domain)) : [];
+  if (domains.length === 0) return void 0;
+  if (entry.methods === void 0) return { domains };
+  const methods = Array.isArray(entry.methods) ? entry.methods.filter((method) => typeof method === "string" && methoddomain(method) !== void 0 && domains.includes(methoddomain(method))) : [];
+  if (methods.length === 0) return void 0;
+  return { domains, methods };
+}
+function allowlistcovers(allowlist, method) {
+  const domain = methoddomain(method);
+  if (domain === void 0) return false;
+  if (!allowlist.domains.includes(domain)) return false;
+  if (allowlist.methods !== void 0 && !allowlist.methods.includes(method)) return false;
+  return true;
+}
+function attachcdpsession(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, tabid: input.tabid, origin: input.origin, attachedat: input.now, domains: [...new Set(input.domains)], debuggerversion: input.debuggerversion };
+}
+function detachcdpsession(session, at, userdetached = false) {
+  return { ...session, detachedat: at, ...userdetached ? { userdetached: true } : {} };
+}
+function sendcdpcommand(input) {
+  const domain = methoddomain(input.method);
+  if (domain === void 0) return { ...input, method: input.method.trim(), domain: "", duration: input.duration, ...input.errorclass !== void 0 ? { errorclass: input.errorclass } : { errorclass: "malformedmethod" }, at: input.at };
+  return { ...input, method: input.method.trim(), domain, duration: input.duration, ...input.errorclass !== void 0 ? { errorclass: input.errorclass } : {}, at: input.at };
+}
+function serializecdpcommand(queue, command) {
+  return [...queue, command];
+}
+function cdpeventruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const domain = typeof entry.domain === "string" && cdpdomains.includes(entry.domain) ? entry.domain : void 0;
+  const event = typeof entry.event === "string" && entry.event.trim() ? entry.event.trim() : void 0;
+  if (domain === void 0 || event === void 0) return void 0;
+  const match = typeof entry.match === "string" && entry.match.trim() ? entry.match.trim() : void 0;
+  return { domain, event, ...match !== void 0 ? { match } : {} };
+}
+function watchcdpevents(rules, events) {
+  const matched = [];
+  const counts = {};
+  for (const domain of cdpdomains) counts[domain] = 0;
+  for (const event of events) {
+    for (const rule of rules) {
+      if (rule.domain !== event.domain || rule.event !== event.event) continue;
+      if (rule.match !== void 0 && !(event.payload ?? "").includes(rule.match)) continue;
+      matched.push({ ruleid: rule.id, domain: event.domain, event: event.event, ...event.payload !== void 0 ? { payload: event.payload } : {} });
+      counts[event.domain] = (counts[event.domain] ?? 0) + 1;
+    }
+  }
+  return { matched, counts };
+}
+function breakpointinputof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const url = typeof entry.url === "string" && entry.url.trim() ? entry.url.trim() : void 0;
+  const line = typeof entry.line === "number" && Number.isInteger(entry.line) && entry.line >= 0 ? entry.line : void 0;
+  if (url === void 0 || line === void 0) return void 0;
+  const column = typeof entry.column === "number" && Number.isInteger(entry.column) && entry.column >= 0 ? entry.column : void 0;
+  const condition = typeof entry.condition === "string" && entry.condition.trim() ? entry.condition.trim() : void 0;
+  return { url, line, ...column !== void 0 ? { column } : {}, ...condition !== void 0 ? { condition } : {} };
+}
+function capturepause(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, reason: input.reason, callframes: [...input.callframes], ...input.hitbreakpoint !== void 0 ? { hitbreakpoint: input.hitbreakpoint } : {}, ...input.domsnapshotid !== void 0 ? { domsnapshotid: input.domsnapshotid } : {}, at: input.at };
+}
+function stepmodeof(value) {
+  const modes = ["stepover", "stepinto", "stepout", "resume"];
+  return typeof value === "string" && modes.includes(value) ? value : void 0;
+}
+function watchexpressionof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const expression = typeof entry.expression === "string" && entry.expression.trim() ? entry.expression.trim() : void 0;
+  if (expression === void 0) return void 0;
+  const scope = typeof entry.scope === "string" && entry.scope.trim() ? entry.scope.trim() : "topframe";
+  return { expression, scope };
+}
+function recordwatchvalue(expression, pauseid, value, at) {
+  return { ...expression, values: [...expression.values, { pauseid, value, at }] };
+}
+function overrideinputof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const urlpattern = typeof entry.urlpattern === "string" && entry.urlpattern.trim() ? entry.urlpattern.trim() : void 0;
+  const source = typeof entry.source === "string" ? entry.source : void 0;
+  if (urlpattern === void 0 || source === void 0 || source.trim().length === 0) return void 0;
+  return { urlpattern, source };
+}
+function teardownplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const revertsteps = Array.isArray(entry.revertsteps) ? entry.revertsteps.filter((step) => typeof step === "string" && step.trim().length > 0) : [];
+  const policy = entry.resumepolicy;
+  if (revertsteps.length === 0) return void 0;
+  if (policy !== void 0 && policy !== "resume" && policy !== "pause" && policy !== "ask") return void 0;
+  return { revertsteps, resumepolicy: policy ?? "ask" };
+}
+function teardowncdpsession(input) {
+  const revertedbreakpoints = input.breakpoints.filter((spec) => spec.revertedat === void 0).map((spec) => spec.id);
+  const revertedoverrides = input.overrides.filter((spec) => spec.revertedat === void 0).map((spec) => spec.id);
+  const resumepolicy = input.userdetached ? "pause" : input.plan?.resumepolicy ?? "ask";
+  return {
+    session: detachcdpsession(input.session, input.at, input.userdetached),
+    revertedbreakpoints,
+    revertedoverrides,
+    resumepolicy,
+    paused: input.userdetached || resumepolicy === "pause",
+    keepsalive: input.userdetached
+  };
+}
+
 // netauth.ts
 function oauthflowof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -2043,10 +2362,107 @@ ${file.content}\r
   return { chunks, boundary, bytes: chunks.reduce((total, chunk) => total + chunk.length, 0) };
 }
 
+// runtimeline.ts
+var timelinekinds = ["watchconsole", "watcherrors", "watchtasks"];
+var loglevels = ["error", "warn", "info", "log", "debug", "trace"];
+var timelinesources = ["console", "error", "rejection", "resource", "longtask", "network", "cdp"];
+function attachtimeline(input) {
+  return { runid: input.runid, origin: input.origin, stepids: [...input.stepids], attachedat: input.now, entries: [] };
+}
+function spamdetect(entries, rule) {
+  const collapsed = [];
+  const counts = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (rule.pattern !== "" && !entry.message.includes(rule.pattern)) {
+      collapsed.push({ ...entry, repeat: 1 });
+      continue;
+    }
+    const key = `${entry.level}|${entry.source}|${entry.message}`;
+    const previous = collapsed[collapsed.length - 1];
+    if (previous && previous.repeat !== void 0 && `${previous.level}|${previous.source}|${previous.message}` === key && entry.time - previous.time <= rule.windowsize) {
+      previous.repeat += 1;
+      continue;
+    }
+    collapsed.push({ ...entry, repeat: 1 });
+  }
+  for (const entry of collapsed) {
+    if (entry.repeat > 1) counts.set(`${entry.level}|${entry.source}|${entry.message}`, entry.repeat);
+  }
+  const flagged = [...counts.entries()].filter(([, count]) => count > rule.collapse).map(([key, count]) => ({ message: key.split("|").slice(2).join("|"), count }));
+  return { entries: collapsed, flagged };
+}
+function rotatelogs(entries, rule) {
+  if (entries.length <= rule.maxentries) return { kept: [...entries], overflow: [] };
+  const kept = entries.slice(entries.length - rule.maxentries);
+  const overflow = entries.slice(0, entries.length - rule.maxentries);
+  return { kept, overflow };
+}
+function timelinecounts(entries) {
+  const counts = {};
+  for (const level of loglevels) counts[level] = 0;
+  for (const entry of entries) counts[entry.level] = (counts[entry.level] ?? 0) + 1;
+  return counts;
+}
+function blockingduration(tasks, stepid, window2) {
+  const inside = tasks.filter((task) => task.starttime >= window2.startedat && task.starttime <= window2.endedat);
+  return { stepid, blocking: inside.reduce((total, task) => total + task.duration, 0), tasks: inside.length };
+}
+function netfailureentryof(input) {
+  const exchange = input.exchange;
+  if (exchange.errorclass === void 0 && exchange.status < 400) return null;
+  return { id: input.id, runid: exchange.runid, stepid: exchange.stepid, url: exchange.url, status: exchange.status, errorclass: exchange.errorclass ?? "httperror", correlationid: exchange.correlationid, at: input.at };
+}
+function watcherdetached(input) {
+  for (const navigation of input.navigations) {
+    if (navigation >= input.startedat && navigation <= input.startedat + input.lifetime) return { detached: true, at: navigation };
+  }
+  return { detached: false };
+}
+function consolediff(input) {
+  const base = input.baselines;
+  const target = input.targetlines;
+  const basemap = /* @__PURE__ */ new Map();
+  for (const line of base) basemap.set(line, (basemap.get(line) ?? 0) + 1);
+  const targetmap = /* @__PURE__ */ new Map();
+  for (const line of target) targetmap.set(line, (targetmap.get(line) ?? 0) + 1);
+  const lines = [];
+  const added = [];
+  const removed = [];
+  const repeated = [];
+  for (const [line, count] of targetmap) {
+    const basecount = basemap.get(line) ?? 0;
+    if (basecount === 0) {
+      for (let index = 0; index < count; index += 1) {
+        lines.push({ kind: "added", text: line });
+        added.push(line);
+      }
+      continue;
+    }
+    const share = Math.min(basecount, count);
+    for (let index = 0; index < share; index += 1) {
+      lines.push({ kind: "repeated", text: line, count: share });
+      repeated.push(line);
+    }
+    for (let index = share; index < count; index += 1) {
+      lines.push({ kind: "added", text: line });
+      added.push(line);
+    }
+  }
+  for (const [line, count] of basemap) {
+    const targetcount = targetmap.get(line) ?? 0;
+    const missing = Math.max(0, count - targetcount);
+    for (let index = 0; index < missing; index += 1) {
+      lines.push({ kind: "removed", text: line });
+      removed.push(line);
+    }
+  }
+  return { base: input.baseid, target: input.targetid, lines, added: added.length, removed: removed.length, repeated: repeated.length, at: input.now };
+}
+
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles"]);
-var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -2062,6 +2478,8 @@ var httpactions = /* @__PURE__ */ new Set(["fetchurl", "parsejson", "parsehtml",
 var socketactions = /* @__PURE__ */ new Set(["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"]);
 var netwatchactions = /* @__PURE__ */ new Set(["watchrequests", "readheaders", "capturebodies", "mapapi", "extractapi"]);
 var controlactions = /* @__PURE__ */ new Set(["blockrequest", "mockresponse", "rewriteheaders", "setcookies", "readcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles"]);
+var debugactions = /* @__PURE__ */ new Set(["watchconsole", "watcherrors", "watchtasks"]);
+var cdpactions = /* @__PURE__ */ new Set(["attachcdp", "detachcdp", "cdpcmd", "watchcdp", "setbreakpoint", "stepcode", "watchexpr", "overridescript"]);
 var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
@@ -2077,6 +2495,12 @@ function hostpattern(origin) {
   if (parsed.protocol !== "https:") throw new Error("Only HTTPS origins can be granted.");
   return `${parsed.origin}/*`;
 }
+function isdebugkind(kind) {
+  return debugactions.has(kind);
+}
+function iscdpkind(kind) {
+  return cdpactions.has(kind);
+}
 function actionrisk(kind) {
   if (!allowedactions.has(kind)) throw new Error("Unsupported browser action.");
   if (sensitiveactions.has(kind)) return "sensitive";
@@ -3302,6 +3726,202 @@ function ratelimitbudgetallowed(wait, budget) {
   if (wait !== void 0 && budget !== void 0 && wait > budget) return { allowed: false, reason: `The rate limit wait of ${wait} milliseconds exceeds the reviewed budget of ${budget} milliseconds; review a wider budget or submit later.` };
   return { allowed: true };
 }
+function timelinegate(session, tabid2, origin, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the timeline capture." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot capture the timeline." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot capture the timeline." };
+  if (session.tabid !== tabid2) return { allowed: false, reason: `The timeline capture needs the run tab ${session.tabid} and refuses tab ${tabid2}.` };
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The timeline capture of ${origin} needs the session origin grants first.` };
+  return { allowed: true };
+}
+function consoleconsentcovers(origin, consents) {
+  if (consents.some((consent) => consent.origin === origin && consent.approved === true)) return { allowed: true };
+  return { allowed: false, reason: `Console capture on ${origin} needs the reviewed console consent first; approve the prompt in the review panel.` };
+}
+function stackgate(session, origin) {
+  if (!origingranted(session, origin)) return { allowed: false, reason: `Stack capture of ${origin} stays outside the session origin grants.` };
+  return { allowed: true };
+}
+function debugwaitbudgetallowed(watchwindow, wait) {
+  if (watchwindow !== void 0 && (typeof watchwindow !== "number" || !Number.isFinite(watchwindow) || watchwindow < 0)) return { allowed: false, reason: "The debug watch window must be zero or a positive number of milliseconds." };
+  if (wait !== void 0 && (typeof wait !== "number" || !Number.isFinite(wait) || wait < 0)) return { allowed: false, reason: "The reviewed debug wait budget must be zero or a positive number of milliseconds." };
+  if (watchwindow !== void 0 && wait !== void 0 && watchwindow > wait) return { allowed: false, reason: `The debug watch window of ${watchwindow} milliseconds exceeds the reviewed wait budget of ${wait} milliseconds; review a wider budget or a shorter window.` };
+  return { allowed: true };
+}
+function validatetimelinegrammar(step, options) {
+  const kind = step.kind;
+  let watchwindow;
+  if (options.watch !== void 0) {
+    const watch = options.watch;
+    if (!watch || typeof watch !== "object" || Array.isArray(watch)) return { allowed: false, reason: "The reviewed debug watch window must be an object." };
+    const reviewed = watch;
+    if (reviewed.window !== void 0) {
+      if (typeof reviewed.window !== "number" || !Number.isFinite(reviewed.window) || reviewed.window < 0) return { allowed: false, reason: "The reviewed debug watch window must be zero or a positive number of milliseconds." };
+      watchwindow = reviewed.window;
+    }
+  }
+  const budgetcheck = debugwaitbudgetallowed(watchwindow, typeof options.wait === "number" ? options.wait : void 0);
+  if (!budgetcheck.allowed) return budgetcheck;
+  if (options.level !== void 0 && !loglevels.includes(options.level)) return { allowed: false, reason: `The reviewed level floor must be one of ${loglevels.join(", ")}.` };
+  if (options.sources !== void 0) {
+    if (!Array.isArray(options.sources) || options.sources.length === 0 || !options.sources.every((source) => timelinesources.includes(source))) return { allowed: false, reason: `The reviewed source filters must be a non-empty list of the reviewed timeline sources: ${timelinesources.join(", ")}.` };
+  }
+  if (kind === "watchconsole") {
+    if (options.redact === void 0 || !Array.isArray(options.redact) || options.redact.length === 0 || !options.redact.every((pattern) => isnonempty(pattern))) return { allowed: false, reason: "Console capture requires a reviewed non-empty redaction pattern list before any console text is captured." };
+    if (options.depth !== void 0 && (typeof options.depth !== "number" || !Number.isInteger(options.depth) || options.depth < 1)) return { allowed: false, reason: "The reviewed serialization depth bound must be a positive integer with no code ceiling." };
+    if (options.spam !== void 0) {
+      const rule = spamruleof(options.spam);
+      if (!rule) return { allowed: false, reason: "The reviewed spam rule needs a pattern, a window size and a collapse threshold." };
+      if (rule.collapse < 1) return { allowed: false, reason: "The reviewed spam collapse threshold must be a positive integer of user configured value with no code ceiling." };
+    }
+    if (options.rotation !== void 0) {
+      const rule = rotationruleof(options.rotation);
+      if (!rule) return { allowed: false, reason: "The reviewed rotation rule needs a max entry count and an overflow target." };
+    }
+  }
+  if (kind === "watchtasks") {
+    if (options.threshold !== void 0 && (typeof options.threshold !== "number" || !Number.isFinite(options.threshold) || options.threshold < 0)) return { allowed: false, reason: "The reviewed long task threshold must be zero or a positive number of milliseconds with no code ceiling." };
+  }
+  return { allowed: true };
+}
+function spamruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const pattern = typeof entry.pattern === "string" ? entry.pattern : "";
+  const windowsize = typeof entry.windowsize === "number" && Number.isFinite(entry.windowsize) && entry.windowsize >= 0 ? entry.windowsize : void 0;
+  const collapse = typeof entry.collapse === "number" && Number.isInteger(entry.collapse) ? entry.collapse : void 0;
+  if (windowsize === void 0 || collapse === void 0) return void 0;
+  return { pattern, windowsize, collapse };
+}
+function rotationruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  const maxentries = typeof entry.maxentries === "number" && Number.isInteger(entry.maxentries) && entry.maxentries >= 1 ? entry.maxentries : void 0;
+  const overflowtarget = typeof entry.overflowtarget === "string" && entry.overflowtarget.trim() ? entry.overflowtarget.trim() : void 0;
+  if (maxentries === void 0 || overflowtarget === void 0) return void 0;
+  return { maxentries, overflowtarget };
+}
+function debuggate(session, tabid2, origin, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the devtools protocol step." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot run a devtools protocol step." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot run a devtools protocol step." };
+  if (session.tabid !== tabid2) return { allowed: false, reason: `The devtools protocol step needs the run tab ${session.tabid} and refuses tab ${tabid2}.` };
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The devtools protocol step on ${origin} needs the session origin grants first.` };
+  return { allowed: true };
+}
+function debuggerconsentcovers(origin, domains, grants) {
+  const needed = [...new Set(domains)];
+  const covering = grants.find((grant) => grant.origin === origin && grant.approved === true && grant.revokedat === void 0 && needed.every((domain) => grant.domains.includes(domain)));
+  if (covering) return { allowed: true };
+  if (grants.some((grant) => grant.origin === origin && grant.revokedat !== void 0)) return { allowed: false, reason: `The debugger consent on ${origin} was revoked; approve a new prompt before the devtools protocol runs again.` };
+  return { allowed: false, reason: `The devtools protocol on ${origin} needs the reviewed debugger consent for ${needed.join(", ")} first; approve the prompt with the domain allowlist shown in the review panel.` };
+}
+function validatebreakpointcondition(condition) {
+  const expression = condition.trim();
+  if (expression.length === 0) return { allowed: false, reason: "The breakpoint condition must not be empty." };
+  if (/(?<![=!<>])=(?!=)/.test(expression)) return { allowed: false, reason: "Breakpoint conditions refuse assignment because the reviewed grammar is comparison only." };
+  if (/[A-Za-z_$][\w$]*\s*\(/.test(expression)) return { allowed: false, reason: "Breakpoint conditions refuse calls because the reviewed grammar is comparison only." };
+  const literal = /^(?:-?\d+(?:\.\d+)?|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|true|false|null)$/;
+  const tokens = expression.match(/(?:[A-Za-z_$][\w$]*|-?\d+(?:\.\d+)?|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|===|!==|==|!=|>=|<=|&&|\|\||[!.<>()+\-*\/%])/g);
+  if (tokens === null || tokens.join("") !== expression.replace(/\s+/g, "")) return { allowed: false, reason: "The breakpoint condition must use the reviewed expression grammar of member chains, literals, comparisons, logic operators, negation and parentheses." };
+  const identifierlike = /^(?:true|false|null)$/;
+  for (const token of tokens) {
+    if (literal.test(token) || identifierlike.test(token)) continue;
+    if (["===", "!==", "==", "!=", ">=", "<=", "&&", "||", "!", ".", "(", ")", "<", ">", "+", "-", "*", "/", "%"].includes(token)) continue;
+    if (/^[A-Za-z_$][\w$]*$/.test(token)) continue;
+    return { allowed: false, reason: `The token ${token} of the breakpoint condition stays outside the reviewed expression grammar.` };
+  }
+  return { allowed: true };
+}
+function breakpointbudgetallowed(active, ceiling) {
+  if (ceiling === void 0) return { allowed: true };
+  if (typeof ceiling !== "number" || !Number.isInteger(ceiling) || ceiling < 0) return { allowed: false, reason: "The reviewed breakpoint ceiling must be zero or a positive integer of user configured value with no code ceiling." };
+  if (active >= ceiling) return { allowed: false, reason: `The run already holds ${active} active breakpoint${active === 1 ? "" : "s"} and the reviewed breakpoint ceiling is ${ceiling}; revert one or review a wider ceiling.` };
+  return { allowed: true };
+}
+function breakpointceilingof(settings) {
+  return settings?.breakpointceiling;
+}
+function validatecdpgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "attachcdp") {
+    if (!Array.isArray(options.domains) || options.domains.length === 0 || !options.domains.every((domain) => typeof domain === "string" && cdpdomains.includes(domain))) return { allowed: false, reason: `The attach needs a non-empty enabled domain list of the reviewed domain grammar: ${cdpdomains.join(", ")}.` };
+    if (teardownplanof(options.teardown) === void 0) return { allowed: false, reason: "Every attach needs a reviewed teardown plan with its revert steps and resume policy before approval." };
+    if (options.allowlist !== void 0) {
+      const allowlist = cdpallowlistof(options.allowlist);
+      if (!allowlist || !allowlist.domains.every((domain) => options.domains.includes(domain))) return { allowed: false, reason: "The reviewed method allowlist must stay inside the enabled domains of the attach." };
+    }
+    const budgetcheck = debugwaitbudgetallowed(typeof options.wait === "number" ? options.wait : void 0, void 0);
+    if (!budgetcheck.allowed) return budgetcheck;
+    return { allowed: true };
+  }
+  if (kind === "detachcdp") return { allowed: true };
+  if (kind === "cdpcmd") {
+    const command = options.command && typeof options.command === "object" && !Array.isArray(options.command) ? options.command : void 0;
+    if (!command || typeof command.method !== "string" || methoddomain(command.method) === void 0) return { allowed: false, reason: "The raw command needs a reviewed method of the Domain.method form." };
+    if (command.params !== void 0 && (typeof command.params !== "object" || Array.isArray(command.params))) return { allowed: false, reason: "The raw command params must be a JSON object." };
+    if (command.resultpath !== void 0 && typeof command.resultpath !== "string") return { allowed: false, reason: "The reviewed result path must be a dotted path string." };
+    return { allowed: true };
+  }
+  if (kind === "watchcdp") {
+    if (!Array.isArray(options.events) || options.events.length === 0 || !options.events.every((rule) => cdpeventruleof(rule) !== void 0)) return { allowed: false, reason: "The event watch needs a non-empty reviewed list of domain event rules of the reviewed domain grammar." };
+    let watchwindow;
+    if (options.watch !== void 0) {
+      const watch = options.watch;
+      if (!watch || typeof watch !== "object" || Array.isArray(watch)) return { allowed: false, reason: "The reviewed event watch window must be an object." };
+      const reviewed = watch;
+      if (reviewed.window !== void 0) {
+        if (typeof reviewed.window !== "number" || !Number.isFinite(reviewed.window) || reviewed.window < 0) return { allowed: false, reason: "The reviewed event watch window must be zero or a positive number of milliseconds." };
+        watchwindow = reviewed.window;
+      }
+    }
+    if (watchwindow === void 0) return { allowed: false, reason: "The event watch needs a reviewed lifetime window before any domain event is observed." };
+    const budgetcheck = debugwaitbudgetallowed(watchwindow, typeof options.wait === "number" ? options.wait : void 0);
+    if (!budgetcheck.allowed) return budgetcheck;
+    return { allowed: true };
+  }
+  if (kind === "setbreakpoint") {
+    const breakpoint = breakpointinputof(options.breakpoint);
+    if (!breakpoint) return { allowed: false, reason: "The breakpoint needs a reviewed script url and a zero based line." };
+    if (!ishttpsurl(breakpoint.url)) return { allowed: false, reason: "The breakpoint script url must be a reviewed HTTPS url." };
+    if (breakpoint.condition !== void 0) {
+      const conditioncheck = validatebreakpointcondition(breakpoint.condition);
+      if (!conditioncheck.allowed) return conditioncheck;
+    }
+    return { allowed: true };
+  }
+  if (kind === "stepcode") {
+    if (stepmodeof(options.mode) === void 0) return { allowed: false, reason: "The step code mode must be one of stepover, stepinto, stepout or resume." };
+    return { allowed: true };
+  }
+  if (kind === "watchexpr") {
+    if (watchexpressionof(options.expression) === void 0) return { allowed: false, reason: "The watch expression needs the reviewed expression text." };
+    if (options.reviewed !== true) return { allowed: false, reason: "Watch expressions must be reviewed before evaluation; set the explicit reviewed flag on the step." };
+    return { allowed: true };
+  }
+  if (kind === "overridescript") {
+    const override = overrideinputof(options.override);
+    if (!override) return { allowed: false, reason: "The script override needs a reviewed url pattern and its full fixture source." };
+    if (patternorigin(override.urlpattern) === void 0) return { allowed: false, reason: "Script overrides without a named https origin pattern are refused." };
+    if (options.reviewed !== true) return { allowed: false, reason: "The full fixture source must be reviewed before the script override runs; set the explicit reviewed flag on the step." };
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+function planallowlist(steps) {
+  const attach = steps.find((step) => step.kind === "attachcdp");
+  if (!attach) return void 0;
+  let options = {};
+  try {
+    options = parseoptions(attach);
+  } catch {
+    options = {};
+  }
+  const domains = Array.isArray(options.domains) ? options.domains.filter((domain) => typeof domain === "string" && cdpdomains.includes(domain)) : [];
+  if (domains.length === 0) return void 0;
+  const gated = cdpallowlistof(options.allowlist);
+  return { domains, ...gated?.methods !== void 0 ? { methods: gated.methods } : {} };
+}
 function controltarget(step) {
   let options = {};
   try {
@@ -3711,6 +4331,14 @@ function validatestep(step, origin) {
     const controlcheck = validatecontrolgrammar(step, options);
     if (!controlcheck.allowed) return controlcheck;
   }
+  if (isdebugkind(step.kind)) {
+    const timelinecheck = validatetimelinegrammar(step, options);
+    if (!timelinecheck.allowed) return timelinecheck;
+  }
+  if (iscdpkind(step.kind)) {
+    const cdpcheck = validatecdpgrammar(step, options);
+    if (!cdpcheck.allowed) return cdpcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -3812,6 +4440,50 @@ function canexecute(input) {
     const watchgatecheck = watchgate(input.session, input.settings, now);
     if (!watchgatecheck.allowed) return watchgatecheck;
   }
+  if (isdebugkind(input.step.kind)) {
+    const timelinegatecheck = timelinegate(input.session, input.tabid, input.origin, now);
+    if (!timelinegatecheck.allowed) return timelinegatecheck;
+  }
+  if (iscdpkind(input.step.kind)) {
+    const debuggatecheck = debuggate(input.session, input.tabid, input.origin, now);
+    if (!debuggatecheck.allowed) return debuggatecheck;
+    if (!input.plan) return { allowed: false, reason: "The devtools protocol steps need an approved plan." };
+    const allowlist = planallowlist(input.plan.steps);
+    if (input.step.kind !== "attachcdp") {
+      if (allowlist === void 0) return { allowed: false, reason: "The devtools protocol step needs the attachcdp step of the same plan with its enabled domains first." };
+      if (input.step.kind === "cdpcmd") {
+        let cdpoptions2 = {};
+        try {
+          cdpoptions2 = parseoptions(input.step);
+        } catch {
+          cdpoptions2 = {};
+        }
+        const command = cdpoptions2.command && typeof cdpoptions2.command === "object" && !Array.isArray(cdpoptions2.command) ? cdpoptions2.command : void 0;
+        const method = typeof command?.method === "string" ? command.method : "";
+        if (methoddomain(method) === void 0 || !allowlistcovers(allowlist, method)) return { allowed: false, reason: `The raw command ${method || ""} stays outside the enabled domain allowlist of the plan attach; review the attach domains or the method gates.` };
+      }
+    }
+    let cdpoptions = {};
+    try {
+      cdpoptions = parseoptions(input.step);
+    } catch {
+      cdpoptions = {};
+    }
+    if (input.step.kind === "setbreakpoint") {
+      const breakpoint = breakpointinputof(cdpoptions.breakpoint);
+      if (breakpoint) {
+        const targetgate = origincheck(input.session, breakpoint.url);
+        if (!targetgate.allowed) return targetgate;
+      }
+    }
+    if (input.step.kind === "overridescript") {
+      const override = overrideinputof(cdpoptions.override);
+      if (override) {
+        const targetgate = origincheck(input.session, override.urlpattern);
+        if (!targetgate.allowed) return targetgate;
+      }
+    }
+  }
   if (iscontrolkind(input.step.kind)) {
     const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
     if (!controlgate.allowed) return controlgate;
@@ -4040,9 +4712,20 @@ function recordupload(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `The multipart upload moved chunk ${entry.chunk} of ${entry.chunks} with ${entry.uploaded} of ${entry.bytes} bytes sent.`, details: { upload: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordtimeline(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: true, summary: `Captured ${entry.entries} timeline entr${entry.entries === 1 ? "y" : "ies"} with ${entry.collapsed} collapsed repeat${entry.collapsed === 1 ? "" : "s"}, ${entry.errors} error${entry.errors === 1 ? "" : "s"}, ${entry.rejections} rejection${entry.rejections === 1 ? "" : "s"} and ${entry.longtasks} long task${entry.longtasks === 1 ? "" : "s"}.`, details: { timeline: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordcdp(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const summary = entry.family === "command" ? `The reviewed ${entry.method ?? "raw"} command of the ${entry.domain ?? "unknown"} domain returned in ${entry.duration ?? 0} millisecond${(entry.duration ?? 0) === 1 ? "" : "s"}${entry.errorclass !== void 0 ? ` with the ${entry.errorclass} error class` : ""}.` : `The devtools ${entry.family} step ran${entry.domain !== void 0 ? ` on the ${entry.domain} domain` : ""}${entry.events !== void 0 ? ` and matched ${entry.events} event${entry.events === 1 ? "" : "s"}` : ""}${entry.hits !== void 0 ? ` with ${entry.hits} hit${entry.hits === 1 ? "" : "s"}` : ""}${entry.frames !== void 0 ? ` capturing ${entry.frames} call frame${entry.frames === 1 ? "" : "s"}` : ""}.`;
+  const outcome = { stepid, ok: entry.errorclass === void 0, summary, details: { cdp: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.44";
+var packageversion = "1.1.46";
 
 // types.ts
 var protocolversion = packageversion;
@@ -4067,6 +4750,20 @@ function parseproposal(value, origin, grants) {
   const expiresat = typeof planinput.expiresat === "number" ? planinput.expiresat : createdat + 10 * 60 * 1e3;
   if (expiresat <= createdat) throw new Error("Plan expiry must be in the future.");
   const planwindow = expiresat - createdat;
+  const attachinput = stepsinput.map((input) => record(input)).find((candidate) => candidate.kind === "attachcdp");
+  let planallowlist2;
+  if (attachinput !== void 0) {
+    const attachoptions = (() => {
+      try {
+        return parseoptions({ id: "attach", kind: "attachcdp", summary: "attach", risk: "sensitive", ...typeof attachinput.options === "string" ? { options: attachinput.options } : {} });
+      } catch {
+        return {};
+      }
+    })();
+    const domains = Array.isArray(attachoptions.domains) ? attachoptions.domains.filter((domain) => typeof domain === "string" && cdpdomains.includes(domain)) : [];
+    const gated = cdpallowlistof(attachoptions.allowlist);
+    planallowlist2 = domains.length > 0 ? { domains, ...gated?.methods !== void 0 ? { methods: gated.methods } : {} } : void 0;
+  }
   const steps = stepsinput.map((input, index) => {
     const candidate = record(input);
     const kind = text(candidate.kind, `step ${index + 1} kind`);
@@ -4100,6 +4797,53 @@ function parseproposal(value, origin, grants) {
       const bypass = proxy && typeof proxy === "object" && !Array.isArray(proxy) ? proxy.bypass : void 0;
       if (!Array.isArray(bypass) || bypass.length === 0) throw new Error("Proxy routes without a bypass list are refused.");
     }
+    if (step.kind === "watchconsole" || step.kind === "watcherrors" || step.kind === "watchtasks") {
+      let debugoptions = {};
+      try {
+        debugoptions = parseoptions(step);
+      } catch {
+        debugoptions = {};
+      }
+      const granted = covered.some((pattern) => {
+        try {
+          return new URL(origin).origin === new URL(pattern).origin;
+        } catch {
+          return false;
+        }
+      });
+      if (!granted) throw new Error(`The ${step.kind} capture of ${origin} targets an origin outside the grants.`);
+      if (debugoptions.level !== void 0 && !loglevels.includes(debugoptions.level)) throw new Error(`The reviewed level floor must be one of ${loglevels.join(", ")}.`);
+    }
+    if (iscdpkind(step.kind)) {
+      const granted = covered.some((pattern) => {
+        try {
+          return new URL(origin).origin === new URL(pattern).origin;
+        } catch {
+          return false;
+        }
+      });
+      if (!granted) throw new Error(`The ${step.kind} step of ${origin} targets an origin outside the grants.`);
+      let cdpoptions = {};
+      try {
+        cdpoptions = parseoptions(step);
+      } catch {
+        cdpoptions = {};
+      }
+      if (step.kind === "attachcdp") {
+        if (teardownplanof(cdpoptions.teardown) === void 0) throw new Error("Attach steps without a reviewed teardown plan are refused.");
+        const domains = Array.isArray(cdpoptions.domains) ? cdpoptions.domains.filter((domain) => typeof domain === "string" && cdpdomains.includes(domain)) : [];
+        if (domains.length === 0) throw new Error("Attach steps need a non-empty enabled domain list of the reviewed domain grammar.");
+        const gated = cdpallowlistof(cdpoptions.allowlist);
+        if (cdpoptions.allowlist !== void 0 && (!gated || !gated.domains.every((domain) => domains.includes(domain)))) throw new Error("The reviewed method allowlist must stay inside the enabled domains of the attach.");
+      }
+      if (step.kind === "cdpcmd") {
+        const command = cdpoptions.command && typeof cdpoptions.command === "object" && !Array.isArray(cdpoptions.command) ? cdpoptions.command : void 0;
+        const method = typeof command?.method === "string" ? command.method : "";
+        if (methoddomain(method) === void 0) throw new Error("Raw commands need a reviewed method of the Domain.method form.");
+        if (planallowlist2 === void 0) throw new Error("Raw command steps need the attachcdp step of the same plan with its enabled domains first.");
+        if (!allowlistcovers(planallowlist2, method)) throw new Error(`The raw command ${method} stays outside the enabled domain allowlist of the plan attach.`);
+      }
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -4174,7 +4918,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -4270,6 +5014,25 @@ function controlreport(input) {
   });
   return { version: protocolversion, blocks: input.blocks, mocks, rewrites: input.rewrites, cookies: input.cookies, proxies: input.proxies, ratelimits: input.ratelimits };
 }
+function timelinereport(input) {
+  return { version: protocolversion, entries: input.entries, errors: input.errors, rejections: input.rejections, longtasks: input.longtasks, levelcounts: input.levelcounts };
+}
+function consolediffreport(input) {
+  return { version: protocolversion, diff: input.diff };
+}
+function cdpreport(input) {
+  const overrides = input.overrides.map((spec) => {
+    const { source, ...metadata } = spec;
+    void source;
+    return metadata;
+  });
+  const grants = input.grants.map((grant) => {
+    const { prompt, ...metadata } = grant;
+    void prompt;
+    return metadata;
+  });
+  return { version: protocolversion, sessions: input.sessions, commands: input.commands, events: input.events, breakpoints: input.breakpoints, pauses: input.pauses, watches: input.watches, overrides, grants };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -5958,7 +6721,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds], debug: [...timelinekinds, ...cdpkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -6381,6 +7144,22 @@ async function tracktabupdate(tabid2, changeinfo) {
   if (status === "loading" && url) {
     navbuffers.set(tabid2, [{ event: "beforenavigate", url, timestamp: now }]);
     lastknownurls.set(tabid2, url);
+    for (const [id, watcher] of [...activetimelinewatchers.entries()]) {
+      const detached = watcherdetached({ startedat: watcher.startedat, lifetime: watcher.lifetime, navigations: [now] });
+      if (!detached.detached) continue;
+      const session = await memory.getsession();
+      if (!session || session.tabid !== tabid2) continue;
+      watcher.cancelled = true;
+      await memory.closewatch(id, now).catch(() => {
+      });
+      await audit("timeline", `Watcher ${id} detached when the run tab navigated to ${url} at ${detached.at}; every page hook of the destroyed context is gone with it.`, { sessionid: session.id });
+      activetimelinewatchers.delete(id);
+    }
+    for (const [runid, active] of [...activecdpsessions.entries()]) {
+      if (active.session.detachedat !== void 0 || active.session.tabid !== tabid2) continue;
+      await detachcdpforrun(runid, `the run tab navigated to ${url}`).catch(() => {
+      });
+    }
     return;
   }
   const buffer = navbuffers.get(tabid2) ?? [];
@@ -8909,6 +9688,11 @@ async function executenetwatchstep(step, session, plan, tabid2, origin) {
       observed.push(exchange);
     }
     const failed = observed.filter((exchange) => exchange.errorclass !== void 0).length;
+    for (const exchange of observed) {
+      const failure = netfailureentryof({ id: randomid(), exchange, at: Date.now() });
+      if (!failure) continue;
+      await memory.addtimelineentry({ id: failure.id, runid: failure.runid, stepid: failure.stepid, time: failure.at, level: "error", source: "network", message: `Request ${failure.correlationid} of ${failure.url} failed with the ${failure.errorclass} class${failure.status > 0 ? ` at status ${failure.status}` : ""}.` });
+    }
     await refreshbadge();
     await audit("watch", `Observed ${observed.length} request${observed.length === 1 ? "" : "s"} of the run tab over the reviewed ${window2} millisecond window, derived from the page timing buffers with ${failed} marked failed; headers and bodies stay out of this observation.`, extra);
     return { ok: true, summary: `Observed ${observed.length} request${observed.length === 1 ? "" : "s"} of the run tab${failed > 0 ? ` with ${failed} failed` : ""}.`, details: { network: { exchanges: observed.length, channelstate: "none", messages: 0 }, observed: observed.map((exchange) => ({ correlationid: exchange.correlationid, method: exchange.method, url: exchange.url, status: exchange.status, statusclass: exchange.statusclass, ...exchange.errorclass !== void 0 ? { errorclass: exchange.errorclass } : {}, bytes: exchange.bytes, duration: exchange.timing })), derivation: "The request lifecycle derives from the page performance and navigation buffers; the timing buffers expose no header names, body bytes or subresource status codes." } };
@@ -9026,6 +9810,343 @@ async function executenetwatchstep(step, session, plan, tabid2, origin) {
   void origin;
   throw new Error("Unsupported request observation kind.");
 }
+var activetimelinewatchers = /* @__PURE__ */ new Map();
+function timelinedetail(entry, runid) {
+  if (!entry || typeof entry !== "object") return null;
+  const record2 = entry;
+  if (typeof record2.stepid !== "string" || typeof record2.time !== "number" || typeof record2.message !== "string") return null;
+  if (typeof record2.level !== "string" || !loglevels.includes(record2.level)) return null;
+  if (typeof record2.source !== "string" || !timelinesources.includes(record2.source)) return null;
+  return { id: randomid(), runid, stepid: record2.stepid, time: record2.time, level: record2.level, source: record2.source, message: record2.message };
+}
+async function executetimelinestep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const watch = options.watch && typeof options.watch === "object" && !Array.isArray(options.watch) ? options.watch : {};
+  const watchwindow = typeof watch.window === "number" && Number.isFinite(watch.window) && watch.window >= 0 ? watch.window : 0;
+  const extra = { sessionid: session.id, planid: plan.id, stepid: step.id };
+  if (step.kind === "watchconsole") {
+    const consents = await memory.getconsoleconsents();
+    const consent = consoleconsentcovers(origin, consents);
+    if (!consent.allowed) {
+      const record2 = { id: randomid(), prompt: `Console capture on ${origin} for the reviewed ${watchwindow} millisecond window of step ${step.id}.`, origin, stepid: step.id, at: Date.now() };
+      await memory.setconsoleconsent(record2);
+      await refreshbadge();
+      throw new Error(`${consent.reason} The prompt is open in the review panel; approve it and run the step again.`);
+    }
+  }
+  if (step.kind === "watcherrors") {
+    const stackgatecheck = stackgate(session, origin);
+    if (!stackgatecheck.allowed) throw new Error(stackgatecheck.reason ?? "Stack capture stays outside the session origin grants.");
+  }
+  const startedat = Date.now();
+  const bound = attachtimeline({ runid: plan.id, origin, stepids: plan.steps.map((item) => item.id), now: startedat });
+  const watchid = randomid();
+  const registration = { watchid, kind: step.kind, stepid: step.id, sessionid: session.id, origin, scopes: [], events: [], startedat, lifetime: watchwindow };
+  await memory.addwatch(registration);
+  await audit("timeline", `Watcher ${step.kind} attached under id ${watchid} on ${origin} for the reviewed window of ${watchwindow} milliseconds inside the run tab ${tabid2}.`, extra);
+  activetimelinewatchers.set(watchid, { runid: plan.id, startedat, lifetime: watchwindow, cancelled: false });
+  let output;
+  try {
+    output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The watch returned no result." };
+  } catch (error) {
+    activetimelinewatchers.delete(watchid);
+    await memory.closewatch(watchid, Date.now());
+    await audit("timeline", `Watcher ${watchid} detached when the run tab navigated or closed inside the reviewed window of ${watchwindow} milliseconds.`, extra);
+    return { ok: false, summary: `The ${step.kind} watcher detached when the tab navigated or closed inside the reviewed window; run it again on the settled page (${error instanceof Error ? error.message : String(error)}).` };
+  }
+  const watcherstate = activetimelinewatchers.get(watchid);
+  activetimelinewatchers.delete(watchid);
+  await memory.closewatch(watchid, Date.now());
+  await audit("timeline", `Watcher ${watchid} detached cleanly after its reviewed window of ${watchwindow} milliseconds.`, extra);
+  if (watcherstate?.cancelled) {
+    await audit("timeline", `Watcher ${watchid} cancelled on run cancel or the killswitch; the captured window is discarded.`, extra);
+    return { ok: false, summary: `The ${step.kind} watcher was cancelled with the run; the captured window is discarded.` };
+  }
+  const captured = detailarray(output.details, "entries").map((entry) => timelinedetail(entry, plan.id)).filter((entry) => entry !== null);
+  bound.entries.push(...captured);
+  let collapsed = 0;
+  let flagged = [];
+  let stored = bound.entries;
+  if (step.kind === "watchconsole") {
+    const rule = spamruleof(options.spam);
+    if (rule) {
+      const outcome = spamdetect(bound.entries, rule);
+      stored = outcome.entries;
+      collapsed = bound.entries.length - stored.length;
+      flagged = outcome.flagged;
+    }
+  }
+  const rotation = rotationruleof(options.rotation);
+  let rotationtarget;
+  if (rotation) {
+    const rotated = rotatelogs(stored, rotation);
+    stored = rotated.kept;
+    rotationtarget = { target: rotation.overflowtarget, runid: plan.id, entries: rotated.overflow.length, at: Date.now() };
+  }
+  const errorids = [];
+  const rejectionids = [];
+  const longtasks = [];
+  for (const entry of detailarray(output.details, "errors")) {
+    if (!entry || typeof entry !== "object") continue;
+    const record2 = entry;
+    const id = randomid();
+    errorids.push(id);
+    const capturederror = { id, runid: plan.id, stepid: step.id, message: typeof record2.message === "string" ? record2.message : "", frames: Array.isArray(record2.frames) ? record2.frames : [], sourceurl: typeof record2.sourceurl === "string" ? record2.sourceurl : "", line: typeof record2.line === "number" ? record2.line : 0, at: Date.now() };
+    await memory.adderrorrecord(capturederror);
+  }
+  for (const entry of detailarray(output.details, "rejections")) {
+    if (!entry || typeof entry !== "object") continue;
+    const record2 = entry;
+    const id = randomid();
+    rejectionids.push(id);
+    const capturedrejection = { id, runid: plan.id, stepid: step.id, reason: typeof record2.reason === "string" ? record2.reason : "", frames: Array.isArray(record2.frames) ? record2.frames : [], at: Date.now() };
+    await memory.addrejectionrecord(capturedrejection);
+  }
+  for (const entry of detailarray(output.details, "longtasks")) {
+    if (!entry || typeof entry !== "object") continue;
+    const record2 = entry;
+    const capturedtask = { id: randomid(), runid: plan.id, stepid: step.id, duration: typeof record2.duration === "number" ? record2.duration : 0, starttime: typeof record2.starttime === "number" ? record2.starttime : 0, attributions: Array.isArray(record2.attributions) ? record2.attributions.filter((name) => typeof name === "string") : [], at: Date.now() };
+    longtasks.push(capturedtask);
+    await memory.addlongtask(capturedtask);
+  }
+  for (const entry of stored) await memory.addtimelineentry(entry);
+  if (rotationtarget) await memory.addrotationtarget(rotationtarget);
+  const blocking = blockingduration(longtasks, step.id, { startedat, endedat: Date.now() });
+  const evidence = { entries: stored.length, collapsed, errors: errorids.length, rejections: rejectionids.length, longtasks: longtasks.length };
+  await memory.setprogress(recordtimeline(await memory.getprogress(), plan.id, step.id, evidence, Date.now()));
+  await refreshbadge();
+  const counts = timelinecounts(stored);
+  await audit("timeline", `Captured ${stored.length} timeline entr${stored.length === 1 ? "y" : "ies"} of ${origin} for the reviewed window of ${watchwindow} milliseconds${collapsed > 0 ? ` with ${collapsed} collapsed repeat${collapsed === 1 ? "" : "s"}` : ""}${errorids.length > 0 ? `, ${errorids.length} error${errorids.length === 1 ? "" : "s"}` : ""}${rejectionids.length > 0 ? `, ${rejectionids.length} rejection${rejectionids.length === 1 ? "" : "s"}` : ""}${longtasks.length > 0 ? ` and ${longtasks.length} long task${longtasks.length === 1 ? "" : "s"}` : ""}; console, error and task watching derives from page-injected listeners and the performance buffers.`, extra);
+  return { ok: Boolean(output.ok), summary: output.summary, details: { ...output.details ?? {}, timeline: { entries: stored.length, levels: counts, collapsed }, entries: stored, errorids, rejectionids, longtasks: longtasks.map((task) => ({ ...task, blocking: blocking.blocking })), ...flagged.length > 0 ? { flagged } : {}, ...rotationtarget ? { rotation: rotationtarget } : {} } };
+}
+var cdpderivation = "devthink instrumented harness 1.1.46 (no chrome.debugger permission)";
+var activecdpsessions = /* @__PURE__ */ new Map();
+async function detachcdpforrun(runid, reason, userdetached = false) {
+  const active = activecdpsessions.get(runid);
+  if (!active) return;
+  const at = Date.now();
+  const decision = teardowncdpsession({ session: active.session, breakpoints: active.breakpoints, overrides: active.overrides, plan: active.teardown, userdetached, at });
+  for (const id of decision.revertedbreakpoints) {
+    const spec = active.breakpoints.find((candidate) => candidate.id === id);
+    if (!spec) continue;
+    const reverted = { ...spec, revertedat: at };
+    await memory.addbreakpoint(reverted).catch(() => void 0);
+    await audit("debugger", `Reverted the breakpoint ${id} of ${spec.url}:${spec.line} with ${spec.hits} hit${spec.hits === 1 ? "" : "s"} at ${reason}${spec.condition !== void 0 ? "; the condition stays reviewed in the record" : ""}.`, { stepid: spec.stepid }).catch(() => void 0);
+  }
+  for (const id of decision.revertedoverrides) {
+    const spec = active.overrides.find((candidate) => candidate.id === id);
+    if (!spec) continue;
+    const reverted = { ...spec, revertedat: at };
+    await memory.addscriptoverride(reverted).catch(() => void 0);
+    await audit("debugger", `Reverted the script override ${id} of ${spec.urlpattern} with ${spec.hits} applied evaluation${spec.hits === 1 ? "" : "s"} at ${reason}; the fixture source never enters the audit trail.`, { stepid: spec.stepid }).catch(() => void 0);
+  }
+  for (const rule of active.rules) {
+    if (rule.closedat !== void 0) continue;
+    await memory.setcdpeventrule({ ...rule, closedat: at }).catch(() => void 0);
+  }
+  await memory.setcdpsession(decision.session).catch(() => void 0);
+  await audit("debugger", `Session ${active.session.id} of ${active.session.origin} detached at ${reason} with the reviewed domains ${active.session.domains.join(", ")} enabled${decision.keepsalive ? "; the session record stays alive for review because the user detached the debugger" : ""}.`, { sessionid: active.session.id, planid: runid, stepid: active.session.stepid }).catch(() => void 0);
+  if (!userdetached) {
+    const revoked = await memory.revokedebuggergrants(active.session.origin, at).catch(() => 0);
+    if (revoked > 0) await audit("debugger", `Revoked ${revoked} debugger consent record${revoked === 1 ? "" : "s"} of ${active.session.origin} at ${reason}; the next attach needs a new reviewed prompt.`, { planid: runid }).catch(() => void 0);
+  }
+  if (decision.paused) await audit("pause", `The devtools teardown at ${reason} paused the run for review; the resume policy is ${decision.resumepolicy}.`, { planid: runid }).catch(() => void 0);
+  activecdpsessions.delete(runid);
+  await refreshbadge().catch(() => void 0);
+}
+function cdpstateof(runid, session, teardown) {
+  const existing = activecdpsessions.get(runid);
+  if (existing) return existing;
+  const created = { session, queue: [], rules: [], breakpoints: [], overrides: [], ...teardown !== void 0 ? { teardown } : {}, cancelled: false };
+  activecdpsessions.set(runid, created);
+  return created;
+}
+function pauseframes(entry) {
+  if (!Array.isArray(entry)) return [];
+  return entry.flatMap((frame) => {
+    if (!frame || typeof frame !== "object") return [];
+    const record2 = frame;
+    if (typeof record2.url !== "string" || typeof record2.line !== "number") return [];
+    return [{ url: record2.url, line: record2.line, ...typeof record2.column === "number" ? { column: record2.column } : {}, ...typeof record2.functionname === "string" ? { functionname: record2.functionname } : {} }];
+  });
+}
+async function executecdpstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { sessionid: session.id, planid: plan.id, stepid: step.id };
+  const debuggatecheck = debuggate(session, tabid2, origin, Date.now());
+  if (!debuggatecheck.allowed) throw new Error(debuggatecheck.reason ?? "The devtools protocol step stays outside the debug gate.");
+  const grants = await memory.getdebuggergrants();
+  const domains = Array.isArray(options.domains) ? options.domains.filter((domain) => typeof domain === "string") : [];
+  if (step.kind === "attachcdp") {
+    const consent = debuggerconsentcovers(origin, domains, grants);
+    if (!consent.allowed) {
+      const pending = grants.find((grant) => grant.origin === origin && grant.approved === void 0 && grant.domains.join(",") === domains.join(","));
+      if (!pending) {
+        const record2 = { id: randomid(), prompt: `Debugger attach on ${origin} with the reviewed domains ${domains.join(", ")} enabled for run ${plan.id}.`, origin, domains, consentedat: Date.now() };
+        await memory.setdebuggergrant(record2);
+        await refreshbadge();
+      }
+      throw new Error(`${consent.reason} The prompt is open in the review panel with the domain allowlist shown; approve it and run the step again.`);
+    }
+  } else {
+    const consent = debuggerconsentcovers(origin, planallowlist(plan.steps)?.domains ?? [], grants);
+    if (!consent.allowed) throw new Error(consent.reason ?? "The reviewed debugger consent is missing.");
+  }
+  const active = activecdpsessions.get(plan.id);
+  if (step.kind !== "attachcdp" && (!active || active.session.detachedat !== void 0)) throw new Error("No attached devtools session covers this run; run the attachcdp step first.");
+  if (step.kind === "attachcdp") {
+    const teardown = teardownplanof(options.teardown);
+    const sessionid = randomid();
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The attach returned no result." };
+    if (!output.ok) return output;
+    const record2 = attachcdpsession({ id: sessionid, runid: plan.id, stepid: step.id, tabid: tabid2, origin, domains, now: Date.now(), debuggerversion: cdpderivation });
+    cdpstateof(plan.id, record2, teardown);
+    await memory.setcdpsession(record2);
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "attach", domains: domains.length }, Date.now()));
+    await audit("debugger", `Attached the devtools session ${sessionid} to the run tab ${tabid2} of ${origin} with the reviewed domains ${domains.join(", ")} enabled and the debugger version ${cdpderivation}; the teardown plan reverts ${teardown?.revertsteps.length ?? 0} step${(teardown?.revertsteps.length ?? 0) === 1 ? "" : "s"} with the ${teardown?.resumepolicy ?? "ask"} resume policy.`, extra);
+    await refreshbadge();
+    return { ok: true, summary: output.summary, details: { ...output.details ?? {}, session: record2, cdp: { sessionid, state: "attached", commandids: [] } } };
+  }
+  if (step.kind === "detachcdp") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const before = { breakpoints: active.breakpoints.filter((spec) => spec.revertedat === void 0).length, overrides: active.overrides.filter((spec) => spec.revertedat === void 0).length };
+    await detachcdpforrun(plan.id, "the reviewed detachcdp step");
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "detach", hits: before.breakpoints + before.overrides }, Date.now()));
+    return { ok: true, summary: `Detached the devtools session ${active.session.id} cleanly after reverting ${before.breakpoints} breakpoint${before.breakpoints === 1 ? "" : "s"} and ${before.overrides} override${before.overrides === 1 ? "" : "s"}; the detach is confirmed.`, details: { detached: true, ...before, cdp: { sessionid: active.session.id, state: "detached", commandids: active.queue.map((command) => command.id) } } };
+  }
+  if (step.kind === "cdpcmd") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const command = options.command && typeof options.command === "object" && !Array.isArray(options.command) ? options.command : {};
+    const method = typeof command.method === "string" ? command.method : "";
+    const planlist = planallowlist(plan.steps);
+    const allowlist = { domains: active.session.domains, ...planlist?.methods !== void 0 ? { methods: planlist.methods } : {} };
+    if (!allowlistcovers(allowlist, method)) throw new Error(`The raw command ${method} stays outside the enabled domain allowlist of the run attach.`);
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The command returned no result." };
+    const duration = typeof output.details?.duration === "number" ? output.details.duration : 0;
+    const errorclass = typeof output.details?.errorclass === "string" ? output.details.errorclass : output.ok ? void 0 : "protocolerror";
+    const record2 = sendcdpcommand({ id: randomid(), sessionid: active.session.id, runid: plan.id, stepid: step.id, method, ...command.params && typeof command.params === "object" && !Array.isArray(command.params) ? { params: command.params } : {}, ...typeof command.resultpath === "string" ? { resultpath: command.resultpath } : {}, duration, ...errorclass !== void 0 ? { errorclass } : {}, at: Date.now() });
+    active.queue = serializecdpcommand(active.queue, record2);
+    await memory.addcdpcommand(record2);
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "command", method, domain: record2.domain, duration, ...errorclass !== void 0 ? { errorclass } : {} }, Date.now()));
+    const pausedetails = output.details?.paused;
+    let pauseid;
+    if (pausedetails && typeof pausedetails === "object") {
+      pauseid = randomid();
+      const pause = capturepause({ id: pauseid, runid: plan.id, stepid: step.id, reason: typeof pausedetails.reason === "string" ? pausedetails.reason : "breakpoint", callframes: pauseframes(pausedetails.frames), ...typeof pausedetails.hitbreakpoint === "string" ? { hitbreakpoint: pausedetails.hitbreakpoint } : {}, at: Date.now() });
+      await memory.addpause(pause);
+      await audit("debugger", `The run paused on breakpoint ${pause.hitbreakpoint ?? "unknown"} with ${pause.callframes.length} call frame${pause.callframes.length === 1 ? "" : "s"} captured.`, extra);
+    }
+    await audit("debugger", `Sent the reviewed command ${method} of the ${record2.domain} domain to session ${active.session.id}; it returned in ${duration} millisecond${duration === 1 ? "" : "s"}${errorclass !== void 0 ? ` with the ${errorclass} error class` : ""}; the params never enter the audit trail.`, extra);
+    await refreshbadge();
+    if (!output.ok) return { ok: false, summary: output.summary, details: { ...output.details ?? {}, command: record2, cdp: { sessionid: active.session.id, state: "attached", commandids: active.queue.map((item) => item.id) } } };
+    return { ok: true, summary: output.summary, details: { ...output.details ?? {}, command: record2, ...pauseid !== void 0 ? { pauseid } : {}, cdp: { sessionid: active.session.id, state: "attached", commandids: active.queue.map((item) => item.id) } } };
+  }
+  if (step.kind === "watchcdp") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const rules = [];
+    for (const rule of Array.isArray(options.events) ? options.events : []) {
+      const parsed = rule && typeof rule === "object" && !Array.isArray(rule) ? rule : void 0;
+      const normalized = parsed !== void 0 ? await Promise.resolve(parsed) : void 0;
+      const base = normalized !== void 0 ? { domain: String(normalized.domain ?? ""), event: String(normalized.event ?? ""), ...typeof normalized.match === "string" ? { match: normalized.match } : {} } : void 0;
+      if (!base || !base.domain || !base.event) continue;
+      const record2 = { id: randomid(), sessionid: active.session.id, runid: plan.id, stepid: step.id, domain: base.domain, event: base.event, ...base.match !== void 0 ? { match: base.match } : {}, events: 0, registeredat: Date.now() };
+      rules.push(record2);
+      active.rules.push(record2);
+      await memory.setcdpeventrule(record2);
+    }
+    if (rules.length === 0) throw new Error("The event watch needs at least one reviewed domain event rule.");
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The event watch returned no result." };
+    const observed = detailarray(output.details, "events").flatMap((event) => {
+      if (!event || typeof event !== "object") return [];
+      const record2 = event;
+      if (typeof record2.domain !== "string" || typeof record2.event !== "string") return [];
+      return [{ domain: record2.domain, event: record2.event, ...typeof record2.payload === "string" ? { payload: record2.payload } : {} }];
+    });
+    const matched = watchcdpevents(rules, observed);
+    for (const rule of active.rules) {
+      const count = matched.matched.filter((item) => item.ruleid === rule.id).length;
+      if (count > 0) rule.events += count;
+      await memory.setcdpeventrule({ ...rule });
+    }
+    for (const item of matched.matched) {
+      await memory.addtimelineentry({ id: randomid(), runid: plan.id, stepid: step.id, time: Date.now(), level: "info", source: "cdp", message: `${item.domain}.${item.event}${item.payload !== void 0 ? `: ${item.payload}` : ""}` });
+    }
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "watch", events: matched.matched.length, ...rules[0] !== void 0 ? { domain: rules[0].domain } : {} }, Date.now()));
+    await audit("debugger", `Watched ${rules.length} reviewed domain event rule${rules.length === 1 ? "" : "s"} of session ${active.session.id} for the reviewed window and forwarded ${matched.matched.length} matched event${matched.matched.length === 1 ? "" : "s"} into the run timeline; the subscription closes at run end or on step cancel.`, extra);
+    await refreshbadge();
+    return { ok: Boolean(output.ok), summary: output.summary, details: { ...output.details ?? {}, eventcounts: matched.counts, matched: matched.matched, cdp: { sessionid: active.session.id, state: "attached", commandids: [] } } };
+  }
+  if (step.kind === "setbreakpoint") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const input = breakpointinputof(options.breakpoint);
+    if (!input) throw new Error("The breakpoint input is absent.");
+    const settings = await memory.getsettings();
+    const budgetcheck = breakpointbudgetallowed(active.breakpoints.filter((spec) => spec.revertedat === void 0).length, breakpointceilingof(settings));
+    if (!budgetcheck.allowed) throw new Error(budgetcheck.reason ?? "The breakpoint ceiling refused the registration.");
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The breakpoint registration returned no result." };
+    if (!output.ok) return output;
+    const registered = output.details?.breakpoint;
+    const id = typeof registered?.id === "string" ? registered.id : randomid();
+    const record2 = { id, runid: plan.id, stepid: step.id, url: input.url, line: input.line, ...input.column !== void 0 ? { column: input.column } : {}, ...input.condition !== void 0 ? { condition: input.condition } : {}, hits: 0, registeredat: Date.now() };
+    active.breakpoints.push(record2);
+    await memory.addbreakpoint(record2);
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "breakpoint", hits: 0 }, Date.now()));
+    await audit("debugger", `Registered the reviewed breakpoint ${id} at ${input.url}:${input.line}${input.condition !== void 0 ? ` under the reviewed condition` : ""} of session ${active.session.id}; the run pauses when an instrumented probe of the run hits it.`, extra);
+    return { ok: true, summary: output.summary, details: { ...output.details ?? {}, breakpoint: record2, cdp: { sessionid: active.session.id, state: "attached", commandids: [] } } };
+  }
+  if (step.kind === "stepcode") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The step returned no result." };
+    const pausedetails = output.details?.pausestate;
+    let pauseid;
+    if (pausedetails && typeof pausedetails === "object") {
+      pauseid = randomid();
+      const domversion = await memory.nextobservationversion().catch(() => void 0);
+      const pause = capturepause({ id: pauseid, runid: plan.id, stepid: step.id, reason: typeof pausedetails.reason === "string" ? pausedetails.reason : "step", callframes: pauseframes(pausedetails.frames), ...typeof pausedetails.hitbreakpoint === "string" ? { hitbreakpoint: pausedetails.hitbreakpoint } : {}, ...domversion !== void 0 ? { domsnapshotid: String(domversion) } : {}, at: Date.now() });
+      await memory.addpause(pause);
+    }
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "step", frames: pauseframes(pausedetails?.frames).length }, Date.now()));
+    await audit("debugger", `Stepped the paused probe of session ${active.session.id} with the ${stepmodeof(options.mode) ?? "reviewed"} mode and captured the pause state${pauseid !== void 0 ? ` as ${pauseid} with the dom snapshot through the page bridge` : ""}.`, extra);
+    return { ok: Boolean(output.ok), summary: output.summary, details: { ...output.details ?? {}, ...pauseid !== void 0 ? { pauseid } : {}, cdp: { sessionid: active.session.id, state: "attached", commandids: [] } } };
+  }
+  if (step.kind === "watchexpr") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const input = watchexpressionof(options.expression);
+    if (!input) throw new Error("The watch expression input is absent.");
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The watch expression returned no result." };
+    const stored = (await memory.getwatchexpressions()).find((item) => item.stepid === step.id);
+    const base = stored ?? { id: randomid(), runid: plan.id, stepid: step.id, expression: input.expression, scope: input.scope, reviewed: true, values: [], at: Date.now() };
+    if (output.ok) {
+      const value = typeof output.details?.value === "string" ? output.details.value : "";
+      const pauses = await memory.listpauses(plan.id);
+      const pauseid = pauses[0]?.id ?? "nopause";
+      const updated = recordwatchvalue(base, pauseid, value, Date.now());
+      await memory.setwatchexpression(updated);
+      await memory.addtimelineentry({ id: randomid(), runid: plan.id, stepid: step.id, time: Date.now(), level: "debug", source: "cdp", message: `Watch expression ${input.expression} evaluated to ${value} at pause ${pauseid} in the ${input.scope} scope.` });
+    }
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "watch", events: base.values.length }, Date.now()));
+    await audit("debugger", `Evaluated the reviewed watch expression of step ${step.id} at the pause in the ${input.scope} scope; the value stores with its pause scope in the timeline and the expression text stays reviewed.`, extra);
+    return { ok: Boolean(output.ok), summary: output.summary, details: { ...output.details ?? {}, cdp: { sessionid: active.session.id, state: "attached", commandids: [] } } };
+  }
+  if (step.kind === "overridescript") {
+    if (!active) throw new Error("No attached devtools session covers this run.");
+    const override = options.override && typeof options.override === "object" && !Array.isArray(options.override) ? options.override : void 0;
+    const urlpattern = typeof override?.urlpattern === "string" ? override.urlpattern : "";
+    const source = typeof override?.source === "string" ? override.source : "";
+    if (!urlpattern || !source) throw new Error("The script override input is absent.");
+    const output = await dispatchpagestep(step, tabid2, origin, plan) ?? { ok: false, summary: "The override returned no result." };
+    if (!output.ok) return output;
+    const applied = output.details?.override;
+    const id = typeof applied?.id === "string" ? applied.id : randomid();
+    const record2 = { id, runid: plan.id, stepid: step.id, urlpattern, source, reviewed: true, reviewedat: Date.now(), hits: 0, appliedat: Date.now() };
+    active.overrides.push(record2);
+    await memory.addscriptoverride(record2);
+    await memory.setprogress(recordcdp(await memory.getprogress(), plan.id, step.id, { family: "override", hits: 0 }, Date.now()));
+    await audit("debugger", `Applied the reviewed script override ${id} of ${urlpattern} on new document evaluation through the page instrumentation; the fixture reverts at run end and the source never enters the audit trail.`, extra);
+    return { ok: true, summary: output.summary, details: { ...output.details ?? {}, override: { id, urlpattern, appliedat: record2.appliedat, reviewed: true }, cdp: { sessionid: active.session.id, state: "attached", commandids: [] } } };
+  }
+  return { ok: false, summary: "The devtools step is not part of the instrumented family." };
+}
 var activerules = /* @__PURE__ */ new Map();
 var activeauthflows = /* @__PURE__ */ new Map();
 function rulesetof(runid) {
@@ -9415,11 +10536,13 @@ async function refreshbadge() {
   const media = (await memory.getmediarecords()).length + (await memory.getimagebatches()).length;
   const recordingprompts = (await memory.getrecordingconsents()).filter((record2) => record2.approved === void 0).length;
   const fetchprompts = (await memory.getfetchconsents()).filter((consent) => consent.approved === void 0).length;
+  const consoleprompts = (await memory.getconsoleconsents()).filter((consent) => consent.approved === void 0).length;
+  const debuggerprompts = (await memory.getdebuggergrants()).filter((grant) => grant.approved === void 0).length;
   const observedrequests = (await memory.getexchanges()).length;
   const livechannels = (await memory.getchannels()).filter((channel) => channel.state === "open" || channel.state === "connecting").length;
   const activerulescount = [...activerules.values()].reduce((total2, ruleset) => total2 + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0);
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + observedrequests + livechannels + activerulescount;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + consoleprompts + debuggerprompts + observedrequests + livechannels + activerulescount;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -9487,6 +10610,12 @@ async function executestep(stepid) {
       output = await executenetwatchstep(step, session, plan, tab.id, origin);
     } else if (iscontrolkind(step.kind)) {
       output = await executenetcontrolstep(step, session, plan, tab.id, origin);
+    } else if (isdebugkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Debugging kinds refuse to run outside an approved session plan.");
+      output = await executetimelinestep(step, session, plan, tab.id, origin);
+    } else if (iscdpkind(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Devtools protocol kinds refuse to run outside an approved session plan.");
+      output = await executecdpstep(step, session, plan, tab.id, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tab.id);
@@ -9544,6 +10673,8 @@ async function executestep(stepid) {
       });
       await revertcontrolsforrun(plan.id, "plan completion").catch(() => {
       });
+      await detachcdpforrun(plan.id, "plan completion").catch(() => {
+      });
       const done = { ...plan, state: "completed", completedat: Date.now() };
       await memory.setplan(done);
       await audit("complete", "Every reviewed step of the approved plan has executed.", { ...session ? { sessionid: session.id } : {}, planid: done.id });
@@ -9706,6 +10837,8 @@ async function handlerequest(message, sender) {
       const apikeys = (await memory.getapikeys()).map((ref) => ({ name: ref.name, origins: ref.origins, header: ref.header, createdat: ref.createdat, ...ref.lastuse !== void 0 ? { lastuse: ref.lastuse } : {} }));
       const traffic = controlreport({ blocks: await memory.getblockrules(), mocks: await memory.getmockspecs(), rewrites: await memory.getheaderules(), cookies: await memory.getcookieops(), proxies: await memory.getproxyroutes(), ratelimits: await memory.getratelimits(Date.now()) });
       const tokens = authreport({ tokens: await memory.listtokens() });
+      const timelineentries = await memory.gettimeline();
+      const timeline = timelinereport({ entries: timelineentries, errors: await memory.geterrorrecords(), rejections: await memory.getrejectionrecords(), longtasks: await memory.getlongtasks(), levelcounts: timelinecounts(timelineentries) });
       const authflows = [...activeauthflows.values()].map((active) => ({ provider: active.flow.provider, redirectorigin: active.flow.redirectorigin, scopes: active.flow.scopes, stepid: active.stepid, tabid: active.tabid ?? 0, stage: active.cancelled ? "cancelled" : "consent" }));
       const runsettings = await memory.getsettings();
       const scanhooks = [];
@@ -9718,7 +10851,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, socketsactive: activesockets.size, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, socketsactive: activesockets.size, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -9763,7 +10896,8 @@ async function handlerequest(message, sender) {
       const capture = outcome.details?.capture;
       const media = outcome.details?.media;
       const network = outcome.details?.network;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {} }));
+      const timeline = outcome.details?.timeline;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {}, ...timeline ? { timeline } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -10374,6 +11508,39 @@ async function handlerequest(message, sender) {
       await audit("configure", `The user set the captured body retention to ${retention === void 0 ? "keep every body" : retention} record${retention === 1 ? "" : "s"}; the exchange metadata always survives.`);
       return { bodyretention: retention };
     }
+    case "settimelineretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { timelineretention: retention } : {} });
+      await audit("configure", `The user set the timeline retention to ${retention === void 0 ? "keep every entry" : retention} entr${retention === 1 ? "y" : "ies"}; the level count summaries always survive.`);
+      return { timelineretention: retention };
+    }
+    case "approveconsoleconsent": {
+      const inputapprove = message;
+      const records = await memory.getconsoleconsents();
+      const record2 = records.find((item) => item.id === inputapprove.id);
+      if (!record2) throw new Error("No console capture prompt matches the id.");
+      const decided = { ...record2, approved: true, usedat: Date.now() };
+      await memory.setconsoleconsent(decided);
+      await audit("consent", `Console capture on ${record2.origin} approved from the review panel; the decision persists for that origin.`, { stepid: record2.stepid });
+      await refreshbadge();
+      return { approved: true, origin: record2.origin };
+    }
+    case "consolediff": {
+      const inputdiff = message;
+      const base = inputdiff.base?.trim();
+      const target = inputdiff.target?.trim();
+      if (!base || !target) throw new Error("Console diffing needs the two reviewed run ids.");
+      if (base === target) throw new Error("Console diffing needs two different run ids.");
+      const baselines = (await memory.listtimeline({ runid: base })).filter((entry) => entry.source === "console").map((entry) => entry.message);
+      const targetlines = (await memory.listtimeline({ runid: target })).filter((entry) => entry.source === "console").map((entry) => entry.message);
+      if (baselines.length === 0 && targetlines.length === 0) throw new Error("Neither run stored console output yet; run watchconsole on both runs first.");
+      const diff = consolediff({ baseid: base, targetid: target, baselines, targetlines, now: Date.now() });
+      await memory.addconsolediff(diff);
+      await audit("diff", `Diffed the console output of runs ${base} and ${target}: ${diff.added} added, ${diff.removed} removed and ${diff.repeated} repeated line${diff.added + diff.removed + diff.repeated === 1 ? "" : "s"}.`);
+      return consolediffreport({ diff });
+    }
     case "trafficreport": {
       const plan = await memory.getplan();
       if (!plan) throw new Error("No plan is available for a traffic control envelope.");
@@ -10458,12 +11625,81 @@ async function handlerequest(message, sender) {
       await refreshbadge();
       return { closed: true, id: inputclose.id ?? "" };
     }
+    case "setpauseretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { pauseretention: retention } : {} });
+      await audit("configure", `The user set the pause capture retention to ${retention === void 0 ? "keep every capture" : `${retention} capture${retention === 1 ? "" : "s"}`}; the pause reason and hit breakpoint always survive.`);
+      return { pauseretention: retention };
+    }
+    case "setbreakpointceiling": {
+      const inputceiling = message;
+      const settings = await memory.getsettings();
+      const ceiling = typeof inputceiling.ceiling === "number" && Number.isInteger(inputceiling.ceiling) && inputceiling.ceiling >= 0 ? inputceiling.ceiling : void 0;
+      await memory.setsettings({ ...settings, ...ceiling !== void 0 ? { breakpointceiling: ceiling } : {} });
+      await audit("configure", `The user set the breakpoint ceiling to ${ceiling === void 0 ? "no ceiling" : `${ceiling} breakpoint${ceiling === 1 ? "" : "s"} per run`}; an absent value never refuses a breakpoint.`);
+      return { breakpointceiling: ceiling };
+    }
+    case "approvedebuggerconsent": {
+      const inputapprove = message;
+      const records = await memory.getdebuggergrants();
+      const record2 = records.find((item) => item.id === inputapprove.id);
+      if (!record2) throw new Error("No debugger consent prompt matches the id.");
+      const decided = { ...record2, approved: true, usedat: Date.now() };
+      await memory.setdebuggergrant(decided);
+      await audit("debugger", `Debugger consent on ${record2.origin} approved from the review panel with the domain allowlist ${record2.domains.join(", ")} shown; the decision covers those domains only.`, { stepid: record2.id });
+      await refreshbadge();
+      return { approved: true, origin: record2.origin, domains: record2.domains };
+    }
+    case "revokedebuggerconsent": {
+      const session = await memory.getsession();
+      const plan = await memory.getplan();
+      const origin = session?.origin;
+      if (!origin) throw new Error("No active session origin covers a debugger consent revoke.");
+      const revoked = await memory.revokedebuggergrants(origin, Date.now());
+      if (plan) await detachcdpforrun(plan.id, "the user detached the debugger", true);
+      if (session) await memory.setsession({ ...session, pausedat: session.pausedat ?? Date.now() });
+      await audit("debugger", `The user detached the debugger: ${revoked} consent record${revoked === 1 ? "" : "s"} of ${origin} revoked, every breakpoint and override reverted, the session record stays alive for review and the run paused for review before continuing.`, { ...session ? { sessionid: session.id } : {}, ...plan ? { planid: plan.id } : {} });
+      await refreshbadge();
+      return { revoked, paused: true };
+    }
+    case "revertcdpoverride": {
+      const inputrevert = message;
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a script override revert.");
+      const active = activecdpsessions.get(plan.id);
+      const stored = (await memory.getscriptoverrides()).find((spec) => spec.id === inputrevert.id);
+      if (!stored) throw new Error(`No script override matches ${inputrevert.id ?? ""}.`);
+      if (stored.revertedat !== void 0) throw new Error("The script override already reverted.");
+      const reverted = { ...stored, revertedat: Date.now() };
+      if (active) {
+        const index = active.overrides.findIndex((spec) => spec.id === stored.id);
+        if (index >= 0) active.overrides[index] = reverted;
+      }
+      await memory.addscriptoverride(reverted);
+      await audit("debugger", `Reverted the script override ${reverted.id} of ${reverted.urlpattern} from the review panel; later evaluations run the original source again and the fixture source never entered the audit trail.`, { planid: plan.id, stepid: reverted.stepid });
+      await refreshbadge();
+      return { reverted: true, id: reverted.id };
+    }
+    case "cdpreport": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a devtools protocol envelope.");
+      return cdpreport({ sessions: await memory.getcdpsessions(), commands: await memory.getcdpcommands(), events: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watches: await memory.getwatchexpressions(), overrides: await memory.getscriptoverrides(), grants: await memory.getdebuggergrants() });
+    }
     case "stop": {
       const session = await memory.getsession();
       for (const [id, controller] of [...activefetches.entries()]) {
         controller.abort();
         activefetches.delete(id);
       }
+      for (const [id, watcher] of [...activetimelinewatchers.entries()]) {
+        watcher.cancelled = true;
+        await memory.closewatch(id, Date.now()).catch(() => {
+        });
+        await audit("timeline", `Watcher ${id} cancelled on run cancel or the killswitch; the captured window is discarded.`, { ...session ? { sessionid: session.id } : {}, ...watcher.runid ? { planid: watcher.runid } : {} });
+        activetimelinewatchers.delete(id);
+      }
       const stoppedplan = await memory.getplan();
       if (stoppedplan) {
         await closechannelsforrun(stoppedplan.id).catch(() => {
@@ -10472,12 +11708,19 @@ async function handlerequest(message, sender) {
         });
         await revertcontrolsforrun(stoppedplan.id, "run cancel").catch(() => {
         });
+        await detachcdpforrun(stoppedplan.id, "run cancel").catch(() => {
+        });
       } else {
         await closechannelsforrun("none").catch(() => {
         });
         await revertcontrolsforrun("none", "run cancel").catch(() => {
         });
       }
+      for (const [runid, active] of [...activecdpsessions.entries()]) {
+        active.cancelled = true;
+        await detachcdpforrun(runid, "run cancel").catch(() => {
+        });
+      }
       for (const [id, active] of [...activerecordings.entries()]) {
         const finished = finishrecording(active.record, Date.now());
         await memory.addmedia(finished).catch(() => {