@wenathlan/extension 1.1.59 → 1.1.61

package/extension/dist/sidepanel.js

@@ -71,6 +71,51 @@ function regexruleof(value) {
   return { pattern: candidate.pattern, flags: candidate.flags, groups };
 }
 
+// originpolicy.ts
+function stepoptions(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var paymentkinds = /* @__PURE__ */ new Set(["fillcard", "fillcode"]);
+var credentialkinds = /* @__PURE__ */ new Set(["consentpassword", "saveapikey", "handleauth", "authflow"]);
+var deletekinds = /* @__PURE__ */ new Set(["discardtab", "closepattern", "clearcookies", "removeattribute", "cleanupartifacts"]);
+var publishkinds = /* @__PURE__ */ new Set(["postform", "postfiles", "sendmessage", "submitform", "submitsearch", "writeclipboard"]);
+var defaultsensitivekinds = /* @__PURE__ */ new Set(["attachfile", "uploadfile", "uploadfiles", "downloadfile", "downloadimages", "batchdownload", "pausedownload", "resumedownload", "quarantinedownload", "evaluate"]);
+function sensitiveclassesof(step) {
+  const options2 = stepoptions(step);
+  const fields = Array.isArray(options2.fields) ? options2.fields.filter((item) => Boolean(item) && typeof item === "object") : [];
+  const names = [...fields.map((field) => typeof field.name === "string" ? field.name : ""), typeof options2.field === "string" ? options2.field : "", typeof options2.target === "string" ? options2.target : ""].map((name) => name.toLowerCase());
+  const carries = (shape) => names.some((name) => name.includes(shape));
+  const classes = /* @__PURE__ */ new Set();
+  if (paymentkinds.has(step.kind) || carries("card") || carries("cvc") || carries("cvv")) classes.add("payment");
+  const credentialshape = carries("password") || carries("token") || carries("secret") || carries("apikey") || carries("passphrase");
+  const submits = step.kind === "submitform" || step.kind === "postform" || step.kind === "submitsearch" || step.kind === "fillform" || step.kind === "filllabel" || step.kind === "fillplaceholder";
+  if (credentialkinds.has(step.kind) || submits && credentialshape) classes.add("credential");
+  if (deletekinds.has(step.kind)) classes.add("delete");
+  if (publishkinds.has(step.kind) || step.kind === "callrest" || step.kind === "callgraphql") {
+    const verb = typeof options2.method === "string" ? options2.method.trim().toUpperCase() : typeof options2.verb === "string" ? options2.verb.trim().toUpperCase() : "";
+    if (step.kind === "callrest" || step.kind === "callgraphql") {
+      if (verb !== "" && !["GET", "HEAD", "OPTIONS"].includes(verb)) classes.add("publish");
+    } else classes.add("publish");
+  }
+  const bydefault = defaultsensitivekinds.has(step.kind);
+  const list = [...classes];
+  if (list.length === 0 && !bydefault) return { classes: [], bydefault: false, sensitive: false, reason: `The ${step.kind} kind carries no sensitive class and no default sensitive grade.` };
+  return { classes: list, bydefault, sensitive: true, reason: `The ${step.kind} kind grades sensitive${list.length > 0 ? ` through the ${list.join(", ")} class${list.length === 1 ? "" : "es"}` : ""}${bydefault ? " by default" : ""}.` };
+}
+function denydefaultnotice(origin) {
+  return `The denydefault posture refuses ${origin} until the user adds the origin to the automation allowlist; no step dispatches without the grant.`;
+}
+function profilesummary(profile) {
+  if (profile === void 0) return "No origin profile exists for this origin yet; sensitive steps route through their fresh consent prompts.";
+  return `The origin profile of ${profile.origin} grants ${profile.grants.length} kind${profile.grants.length === 1 ? "" : "s"} and denies ${profile.denials.length} kind${profile.denials.length === 1 ? "" : "s"} the user reviewed.`;
+}
+
 // policy.ts
 var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow", "visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
@@ -319,6 +364,12 @@ function redoedit(model) {
   return { ...next, redo: redo.slice(0, -1), undo: [...model.undo ?? [], current] };
 }
 
+// progress.ts
+function environmentof(progress, planid, stepid) {
+  if (!progress || progress.planid !== planid) return void 0;
+  return (progress.environments ?? {})[stepid];
+}
+
 // extension/tabscommand.ts
 function switcherlist(tabs, recency, filter) {
   const needle = filter.trim().toLowerCase();
@@ -395,6 +446,8 @@ var triggersroot = document.querySelector("#triggers");
 var agentprotocolroot = document.querySelector("#agentprotocol");
 var modelsroot = document.querySelector("#models");
 var agentsroot = document.querySelector("#agents");
+var environmentsroot = document.querySelector("#environments");
+var securityroot = document.querySelector("#security");
 var commandinput = document.querySelector("#command");
 var commandbutton = document.querySelector("#commandsend");
 var intentbadge = document.querySelector("#intentbadge");
@@ -585,6 +638,13 @@ function stepitem(plan, step, completed, outcomes, retries, progress) {
   const item = document.createElement("li");
   const done = completed.includes(step.id);
   item.textContent = `${done ? "\u2713" : ""} ${step.summary}${holddetail(step)}`;
+  const environmentbadge = progress?.planid === plan.id ? environmentof(progress, plan.id, step.id) ?? step.environment : step.environment;
+  if (environmentbadge !== void 0) {
+    const badge = document.createElement("span");
+    badge.className = "muted";
+    badge.textContent = ` [${environmentbadge}]`;
+    item.append(badge);
+  }
   const outcome = renderoutcome(step, outcomes);
   if (outcome) item.append(outcome);
   const timeline = step.kind === "retryaction" ? retrydetail(step, retries) : quietdetail(step, outcomes);
@@ -2883,6 +2943,8 @@ async function refresh() {
   renderagentprotocol(context);
   rendermodels(context);
   renderagents(context);
+  renderenvironments(context);
+  rendersecurity(context);
   renderconsolediff();
   renderaudit(context.audit);
   rendercapabilities(context.capabilities);
@@ -5543,6 +5605,489 @@ function rendermodels(context) {
   }
   modelsroot.append(guardbox);
 }
+function rendersecurity(context) {
+  if (!securityroot) return;
+  securityroot.replaceChildren();
+  const view = context.security;
+  if (!view) {
+    securityroot.textContent = "The security state is unknown.";
+    return;
+  }
+  const head = document.createElement("p");
+  head.textContent = `Posture ${view.posture}: the allowlist holds ${view.allowlist.length} exact origin${view.allowlist.length === 1 ? "" : "s"} with no wildcard expansion, ${view.profiles.length} origin profile${view.profiles.length === 1 ? "" : "s"}, ${view.windows.filter((window2) => window2.state === "active").length} active consent window${view.windows.filter((window2) => window2.state === "active").length === 1 ? "" : "s"} and ${view.revocations.length} recorded revocation${view.revocations.length === 1 ? "" : "s"}.`;
+  securityroot.append(head);
+  const allowbox = document.createElement("details");
+  allowbox.className = "sessiongroup";
+  const allowsummary = document.createElement("summary");
+  allowsummary.textContent = "Automation allowlist (denydefault)";
+  allowbox.append(allowsummary);
+  if (view.allowlist.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No origin is granted yet; the denydefault posture refuses every ungranted origin.";
+    allowbox.append(none);
+  }
+  for (const entry of view.allowlist) {
+    const line = document.createElement("p");
+    line.textContent = `${entry.origin} \xB7 profile workspace ${entry.profileid} \xB7 granted ${new Date(entry.grantedat).toLocaleString()}`;
+    line.append(" ", button("Remove", async () => {
+      await request({ kind: "security", allowlist: { remove: { origin: entry.origin } } });
+      await refresh();
+    }));
+    allowbox.append(line);
+  }
+  const origininput = document.createElement("input");
+  origininput.placeholder = "https://exact.example";
+  origininput.setAttribute("aria-label", "Exact origin to grant");
+  const addorigin = button("Grant exact origin", async () => {
+    const origin = origininput.value.trim();
+    if (origin === "") throw new Error("The allowlist grant needs its exact origin.");
+    await request({ kind: "security", allowlist: { add: { origin } } });
+    origininput.value = "";
+    await refresh();
+  });
+  allowbox.append(origininput, " ", addorigin);
+  const allownote = document.createElement("p");
+  allownote.className = "muted";
+  allownote.textContent = "The allowlist binds every grant to one exact origin with no wildcard expansion; the active tab grant counts as exactly one explicit single origin grant, and grants never outlive their named boundary.";
+  allowbox.append(allownote);
+  securityroot.append(allowbox);
+  const profilebox = document.createElement("details");
+  profilebox.className = "sessiongroup";
+  const profilesummarynode = document.createElement("summary");
+  profilesummarynode.textContent = "Origin profiles";
+  profilebox.append(profilesummarynode);
+  if (view.profiles.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = profilesummary(void 0);
+    profilebox.append(none);
+  }
+  for (const profile of view.profiles) {
+    const line = document.createElement("p");
+    line.textContent = `${profile.origin}: ${profile.grants.length} granted kind${profile.grants.length === 1 ? "" : "s"}${profile.denials.length > 0 ? `, ${profile.denials.length} denied kind${profile.denials.length === 1 ? "" : "s"}` : ""}.`;
+    profilebox.append(line);
+  }
+  if (context.session?.origin !== void 0) {
+    const kindinput = document.createElement("input");
+    kindinput.placeholder = "action kind such as submitform";
+    kindinput.setAttribute("aria-label", "Action kind for the origin profile");
+    profilebox.append(kindinput, " ", button("Grant kind on active origin", async () => {
+      const kind = kindinput.value.trim();
+      if (kind === "") throw new Error("The origin profile decision needs its action kind.");
+      await request({ kind: "security", profile: { origin: context.session?.origin, kind, decision: "grant" } });
+      await refresh();
+    }), " ", button("Deny kind on active origin", async () => {
+      const kind = kindinput.value.trim();
+      if (kind === "") throw new Error("The origin profile decision needs its action kind.");
+      await request({ kind: "security", profile: { origin: context.session?.origin, kind, decision: "deny" } });
+      await refresh();
+    }));
+  }
+  securityroot.append(profilebox);
+  const windowbox = document.createElement("details");
+  windowbox.className = "sessiongroup";
+  const windowsummary = document.createElement("summary");
+  windowsummary.textContent = "Consent windows";
+  windowbox.append(windowsummary);
+  const now = Date.now();
+  if (view.windows.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No consent window exists yet; every sensitive step waits for its prompt.";
+    windowbox.append(none);
+  }
+  for (const window2 of view.windows) {
+    const remaining = window2.state === "active" ? Math.max(0, window2.expiresat - now) : 0;
+    const line = document.createElement("p");
+    line.textContent = `${window2.origin} \xB7 ${window2.state === "active" ? `active, ${Math.ceil(remaining / 1e3)}s of the ${window2.boundary} boundary left` : `closed at ${new Date(window2.closedat ?? window2.expiresat).toLocaleString()}`} \xB7 ${window2.kinds.length} kind${window2.kinds.length === 1 ? "" : "s"} covered.`;
+    if (window2.state === "active") {
+      const durationinput2 = document.createElement("input");
+      durationinput2.placeholder = "duration in ms";
+      durationinput2.setAttribute("aria-label", "Renewal duration in milliseconds");
+      line.append(" ", durationinput2, " ", button("Renew", async () => {
+        const duration = Number(durationinput2.value.trim());
+        const offer = Number.isFinite(duration) && duration > 0 ? duration : view.promptduration;
+        if (offer === void 0) throw new Error("The renewal prompt needs its duration in milliseconds; no grant ever defaults to unlimited.");
+        await request({ kind: "security", consent: { renew: { windowid: window2.id, duration: offer } } });
+        await refresh();
+      }));
+    }
+    windowbox.append(line);
+  }
+  const durationinput = document.createElement("input");
+  durationinput.placeholder = "duration in ms";
+  durationinput.setAttribute("aria-label", "Consent window duration in milliseconds");
+  const offered = view.promptduration !== void 0 ? String(view.promptduration) : "";
+  if (offered !== "") durationinput.value = offered;
+  windowbox.append(durationinput, " ", button("Open consent window", async () => {
+    const duration = Number(durationinput.value.trim());
+    if (!Number.isFinite(duration) || duration <= 0) throw new Error("The consent prompt needs its duration in milliseconds; no grant ever defaults to unlimited.");
+    await request({ kind: "security", consent: { open: { duration } } });
+    await refresh();
+  }));
+  const windownote = document.createElement("p");
+  windownote.className = "muted";
+  windownote.textContent = "Every consent window scopes to one session and one origin and names its boundary; a window past its boundary suspends the run mid step and the executor refuses to resume without a new explicit prompt.";
+  windowbox.append(windownote);
+  securityroot.append(windowbox);
+  const promptbox = document.createElement("details");
+  promptbox.className = "sessiongroup";
+  const promptsummary = document.createElement("summary");
+  promptsummary.textContent = "Consent prompts of the pending plan";
+  promptbox.append(promptsummary);
+  const prompts = view.prompts ?? [];
+  if (prompts.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No sensitive step of the current plan waits for a fresh consent prompt.";
+    promptbox.append(none);
+  }
+  for (const pending of prompts) {
+    const classification = context.plan?.steps.find((step) => step.id === pending.stepid) !== void 0 ? sensitiveclassesof(context.plan.steps.find((step) => step.id === pending.stepid)) : { classes: [], bydefault: false };
+    const line = document.createElement("p");
+    line.textContent = `${pending.prompt}${classification.classes.length > 0 ? ` Class badge: ${classification.classes.join(", ")}.` : classification.bydefault ? " Class badge: sensitive by default." : ""}`;
+    promptbox.append(line);
+  }
+  if (context.session?.origin !== void 0 && prompts.length > 0) {
+    promptbox.append(button("Consent to every sensitive class", async () => {
+      const classes = /* @__PURE__ */ new Set();
+      for (const pending of prompts) for (const step of context.plan?.steps ?? []) if (step.id === pending.stepid) for (const classname of sensitiveclassesof(step).classes) classes.add(classname);
+      if (classes.size === 0) throw new Error("The pending steps grade sensitive by default; open their consent window instead.");
+      await request({ kind: "security", consent: { classes: { origin: context.session?.origin, classes: [...classes] } } });
+      await refresh();
+    }));
+  }
+  securityroot.append(promptbox);
+  const consentbox = document.createElement("div");
+  consentbox.className = "actions";
+  const revoke = button("Revoke consent mid run", async () => {
+    const plan = context.plan;
+    if (!plan) throw new Error("The revocation needs its run; no plan is open.");
+    const halted = plan.steps.map((step) => `${step.id} (${step.kind})`);
+    const confirmnode = document.createElement("p");
+    confirmnode.textContent = `Confirm the revokerun: the pending step and every queued step halt without executing${halted.length > 0 ? ` (${halted.length} step${halted.length === 1 ? "" : "s"} of the plan: ${halted.slice(0, 5).join(", ")}${halted.length > 5 ? ", \u2026" : ""})` : ""}.`;
+    confirmnode.append(" ", button("Confirm revokerun", async () => {
+      await request({ kind: "security", revoke: { runid: plan.id } });
+      await refresh();
+    }), " ", button("Cancel", async () => {
+      confirmnode.remove();
+    }));
+    securityroot.prepend(confirmnode);
+  });
+  consentbox.append(revoke);
+  const revocations = view.revocations;
+  if (revocations.length > 0) consentbox.append(document.createElement("span"), document.createTextNode(`Last revocation: ${revocations[0]?.runid} halted ${revocations[0]?.haltedstepids.length} step${revocations[0]?.haltedstepids.length === 1 ? "" : "s"}.`));
+  securityroot.append(consentbox);
+  const maskbox = document.createElement("details");
+  maskbox.className = "sessiongroup";
+  const masksummary = document.createElement("summary");
+  masksummary.textContent = "Mask rules for sensitive field shapes";
+  maskbox.append(masksummary);
+  const shapeinput = document.createElement("input");
+  shapeinput.placeholder = "field shape such as accountnumber";
+  shapeinput.setAttribute("aria-label", "Field shape to mask");
+  maskbox.append(shapeinput, " ", button("Add mask shape", async () => {
+    const shape = shapeinput.value.trim();
+    if (shape === "") throw new Error("The mask rule needs its field shape.");
+    await request({ kind: "security", mask: { add: { shapes: [shape] } } });
+    await refresh();
+  }));
+  if (view.maskrules.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No custom mask rule exists; the documented password, token, card and secret shapes always apply.";
+    maskbox.append(none);
+  }
+  for (const rule of view.maskrules) {
+    const line = document.createElement("p");
+    line.textContent = `${rule.shapes.join(", ")}${rule.origin !== void 0 ? ` scoped to ${rule.origin}` : " global"} \xB7 values show as [redacted] fields in step details.`;
+    line.append(" ", button("Remove", async () => {
+      await request({ kind: "security", mask: { remove: { id: rule.id } } });
+      await refresh();
+    }));
+    maskbox.append(line);
+  }
+  securityroot.append(maskbox);
+  const chainbox = document.createElement("details");
+  chainbox.className = "sessiongroup";
+  const chainsummary = document.createElement("summary");
+  chainsummary.textContent = "Run log chain verification";
+  chainbox.append(chainsummary);
+  if (view.chain.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No run log exists yet; the session start writes the consentscope grant into the immutable log.";
+    chainbox.append(none);
+  }
+  for (const chain of view.chain) {
+    const line = document.createElement("p");
+    line.textContent = `${chain.runid}: ${chain.valid ? "chain verified" : `chain broken at entry ${chain.brokenat ?? "unknown"}`} \xB7 ${chain.entries} entries${chain.sealhash !== void 0 ? ` \xB7 seal hash ${chain.sealhash.slice(0, 12)}\u2026 at ${new Date(chain.sealedat ?? 0).toLocaleString()}` : " \xB7 unsealed"}.`;
+    line.append(" ", button("Read log", async () => {
+      const read = await request({ kind: "security", read: { runid: chain.runid } });
+      status(read.verification ?? `The log of ${chain.runid} read through the audit accessor.`);
+    }), " ", button("Export audit file", async () => {
+      const exported = await request({ kind: "security", export: { runid: chain.runid } });
+      status(`The verified run log of ${chain.runid} was exported as an audit file with ${exported.export?.entries ?? 0} entries.`);
+    }));
+    chainbox.append(line);
+  }
+  const chainnote = document.createElement("p");
+  chainnote.className = "muted";
+  chainnote.textContent = "The immutable log appends only: every entry chains through its loghash to its predecessor, the session close seals the chain with a final hash, and the audit accessor refuses reads of a chain with a broken link.";
+  chainbox.append(chainnote);
+  securityroot.append(chainbox);
+  if (view.sessionorigin !== void 0 && !view.allowlist.some((entry) => entry.origin === view.sessionorigin)) {
+    const notice = document.createElement("p");
+    notice.textContent = denydefaultnotice(view.sessionorigin);
+    securityroot.append(notice);
+  }
+}
+function renderenvironments(context) {
+  if (!environmentsroot) return;
+  environmentsroot.replaceChildren();
+  const view = context.environments;
+  if (!view) {
+    environmentsroot.textContent = "The execution environment state is unknown.";
+    return;
+  }
+  const head = document.createElement("p");
+  head.textContent = `Steps by environment: ${view.report.environments.length} executed \xB7 offscreen ${view.offscreengranted ? "granted" : "not granted"} \xB7 parse offload ${view.parseoffload ? "on" : "off"} \xB7 workers ${view.report.workers} \xB7 sandbox origins ${view.sandboxorigins?.length ?? 0} configured.`;
+  environmentsroot.append(head);
+  const keepalive = view.report.keepalive;
+  const keepbox = document.createElement("div");
+  keepbox.className = "actions";
+  const beatinfo = document.createElement("span");
+  beatinfo.textContent = keepalive ? `Keepalive ${keepalive.state}: ${keepalive.beats} beat${keepalive.beats === 1 ? "" : "s"}, port ${keepalive.portopen ? "open" : "closed"}, last beat ${new Date(keepalive.lastbeatat).toLocaleTimeString()}${view.workerpoolsize !== void 0 ? ` \xB7 pool size ${view.workerpoolsize}` : ""}.` : "No run state holds a keepalive port.";
+  keepbox.append(beatinfo);
+  if (keepalive?.state === "active") {
+    keepbox.append(button("Beat now", async () => {
+      await request({ kind: "runstate", beat: true });
+      await refresh();
+    }), button("Close run state", async () => {
+      await request({ kind: "runstate", stop: true });
+      await refresh();
+    }));
+  }
+  environmentsroot.append(keepbox);
+  const keepnote = document.createElement("p");
+  keepnote.className = "muted";
+  keepnote.textContent = "Keepalive runs only during active reviewed plans: the port opens behind an approved plan of an active session and closes at every terminal state.";
+  environmentsroot.append(keepnote);
+  if (view.restartnotice !== void 0 || view.recovery !== void 0) {
+    const notice = document.createElement("p");
+    notice.textContent = view.restartnotice ?? view.recovery?.reason ?? "";
+    if (view.recovery?.recoverable === true) notice.append(" ", button("Resume pending step", async () => {
+      const result = await request({ kind: "runstate", recover: true });
+      status(result.resumed ?? result.recovery?.reason ?? "The recovery finished.");
+      await refresh();
+    }));
+    environmentsroot.append(notice);
+  }
+  if (view.zombies.length > 0) {
+    const warning = document.createElement("p");
+    warning.textContent = `Zombie run${view.zombies.length === 1 ? "" : "s"} whose heartbeat fell silent: ${view.zombies.join(", ")}.`;
+    warning.append(" ", button("Reap zombie runs", async () => {
+      const result = await request({ kind: "runstate", reap: true });
+      status(`The reaper closed ${result.reaped?.length ?? 0} zombie run${result.reaped?.length === 1 ? "" : "s"}.`);
+      await refresh();
+    }));
+    environmentsroot.append(warning);
+  }
+  const grouped = /* @__PURE__ */ new Map();
+  for (const entry of view.report.environments) grouped.set(entry.environment, [...grouped.get(entry.environment) ?? [], entry.stepid]);
+  const groupbox = document.createElement("details");
+  groupbox.className = "sessiongroup";
+  const groupsummary = document.createElement("summary");
+  groupsummary.textContent = "Steps grouped by execution environment";
+  groupbox.append(groupsummary);
+  if (grouped.size === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No step of the open run has executed yet.";
+    groupbox.append(none);
+  }
+  for (const [environment, stepids] of grouped) {
+    const line = document.createElement("p");
+    line.textContent = `${environment}: ${stepids.length} step${stepids.length === 1 ? "" : "s"}${view.report.turnarounds.filter((entry) => stepids.includes(entry.stepid)).length > 0 ? ` \xB7 worker turnaround ${view.report.turnarounds.filter((entry) => stepids.includes(entry.stepid)).map((entry) => `${entry.stepid}: ${entry.milliseconds} ms`).join(", ")}` : ""}`;
+    groupbox.append(line);
+  }
+  environmentsroot.append(groupbox);
+  const grantbox = document.createElement("div");
+  grantbox.className = "actions";
+  const grantinfo = document.createElement("span");
+  grantinfo.textContent = view.grants !== void 0 ? `Session environment grants: ${view.grants.length > 0 ? view.grants.join(", ") : "the documented default posture"}.` : "Session environment grants: the documented default posture (no grant list configured).";
+  grantbox.append(grantinfo);
+  const allenvironments = ["pagecontext", "isolatedworld", "offscreenworker", "sandboxframe"];
+  for (const environment of allenvironments) {
+    const active = view.grants?.includes(environment) ?? false;
+    grantbox.append(" ", button(`${active ? "Revoke" : "Grant"} ${environment}`, async () => {
+      const current = view.grants ?? [];
+      const next = active ? current.filter((entry) => entry !== environment) : [...current, environment];
+      await request({ kind: "environments", grants: next });
+      await refresh();
+    }));
+  }
+  environmentsroot.append(grantbox);
+  const grantnote = document.createElement("p");
+  grantnote.className = "muted";
+  grantnote.textContent = "Environment grants join the origin grants of the session record: a configured list narrows every step to its entries and the request links to the same consent flow the origins use.";
+  environmentsroot.append(grantnote);
+  const capabilitybox = document.createElement("div");
+  capabilitybox.className = "actions";
+  const capabilityinfo = document.createElement("span");
+  capabilityinfo.textContent = `Offscreen capability: ${view.offscreengranted ? "granted" : "absent \u2014 heavy parses keep their inline fallback inside the page"}.`;
+  capabilitybox.append(capabilityinfo);
+  if (!view.offscreengranted) capabilitybox.append(" ", button("Request offscreen capability", async () => {
+    const result = await request({ kind: "environments", requestcapability: true });
+    status(result.requested === true ? "The offscreen capability was granted; the worker pool may spawn." : "The capability request stayed refused; the inline fallback holds.");
+    await refresh();
+  }));
+  else capabilitybox.append(" ", button("Close offscreen document", async () => {
+    await request({ kind: "environments", offscreenclose: true });
+    await refresh();
+  }));
+  environmentsroot.append(capabilitybox);
+  const optionsbox = document.createElement("details");
+  optionsbox.className = "sessiongroup";
+  const optionssummary = document.createElement("summary");
+  optionssummary.textContent = "Environment options";
+  optionsbox.append(optionssummary);
+  const offloadrow = document.createElement("div");
+  offloadrow.className = "actions";
+  offloadrow.append(button(`Parse offload: ${view.parseoffload ? "on" : "off"}`, async () => {
+    await request({ kind: "environments", settings: { parseoffload: !view.parseoffload } });
+    await refresh();
+  }));
+  const poolinput = document.createElement("input");
+  poolinput.type = "number";
+  poolinput.min = "1";
+  poolinput.placeholder = "worker pool size (no cap)";
+  poolinput.value = view.workerpoolsize !== void 0 ? String(view.workerpoolsize) : "";
+  offloadrow.append(" ", poolinput, " ", button("Set pool size", async () => {
+    const value = poolinput.value.trim();
+    await request({ kind: "environments", settings: { ...value !== "" ? { workerpoolsize: Number(value) } : {} } });
+    await refresh();
+  }));
+  optionsbox.append(offloadrow);
+  const origininput = document.createElement("input");
+  origininput.type = "url";
+  origininput.placeholder = "https://origin.example to allow sandbox renders";
+  const originrow = document.createElement("div");
+  originrow.className = "actions";
+  originrow.append(origininput, " ", button("Add sandbox origin", async () => {
+    const value = origininput.value.trim();
+    if (value === "") return;
+    const next = [...view.sandboxorigins ?? [], value];
+    await request({ kind: "environments", settings: { sandboxorigins: next } });
+    await refresh();
+  }));
+  optionsbox.append(originrow);
+  if ((view.sandboxorigins ?? []).length > 0) {
+    const originlist = document.createElement("ul");
+    originlist.className = "audit";
+    for (const origin of view.sandboxorigins ?? []) {
+      const item = document.createElement("li");
+      item.textContent = origin;
+      item.append(" ", button("Remove", async () => {
+        await request({ kind: "environments", settings: { sandboxorigins: (view.sandboxorigins ?? []).filter((entry) => entry !== origin) } });
+        await refresh();
+      }));
+      originlist.append(item);
+    }
+    optionsbox.append(originlist);
+  }
+  const intervalinput = document.createElement("input");
+  intervalinput.type = "number";
+  intervalinput.min = "1";
+  intervalinput.placeholder = "keepalive interval ms (roadmap: 30000)";
+  const intervalrow = document.createElement("div");
+  intervalrow.className = "actions";
+  intervalrow.append(intervalinput, " ", button("Set interval", async () => {
+    const value = intervalinput.value.trim();
+    if (value === "") return;
+    await request({ kind: "environments", settings: { keepaliveinterval: Number(value) } });
+    await refresh();
+  }));
+  optionsbox.append(intervalrow);
+  environmentsroot.append(optionsbox);
+  if (view.registry.length > 0) {
+    const registrybox = document.createElement("details");
+    registrybox.className = "sessiongroup";
+    const registrysummary = document.createElement("summary");
+    registrysummary.textContent = "Executor registry";
+    registrybox.append(registrysummary);
+    const registrylist = document.createElement("ul");
+    registrylist.className = "audit";
+    for (const adapter of view.registry) {
+      const item = document.createElement("li");
+      item.textContent = `${adapter.environment} \u2192 ${adapter.adapter}: ${adapter.description}`;
+      registrylist.append(item);
+    }
+    registrybox.append(registrylist);
+    environmentsroot.append(registrybox);
+  }
+  if (view.report.offscreen.length > 0) {
+    const offbox = document.createElement("details");
+    offbox.className = "sessiongroup";
+    const offsummary = document.createElement("summary");
+    offsummary.textContent = `Offscreen documents (${view.report.offscreen.length})`;
+    offbox.append(offsummary);
+    const offlist = document.createElement("ul");
+    offlist.className = "audit";
+    for (const entry of view.report.offscreen) {
+      const item = document.createElement("li");
+      item.textContent = `${entry.document} for the run ${entry.runid}: ${entry.reasons.join(", ")}${entry.closedat !== void 0 ? ` \xB7 closed ${new Date(entry.closedat).toLocaleTimeString()}` : " \xB7 open"} \u2014 ${entry.justification}`;
+      offlist.append(item);
+    }
+    offbox.append(offlist);
+    environmentsroot.append(offbox);
+  }
+  if (view.workerevents.length > 0) {
+    const workerbox = document.createElement("details");
+    workerbox.className = "sessiongroup";
+    const workersummary = document.createElement("summary");
+    workersummary.textContent = `Worker activity (${view.workerevents.length})`;
+    workerbox.append(workersummary);
+    const workerlist = document.createElement("ul");
+    workerlist.className = "audit";
+    for (const event of view.workerevents.slice(0, 10)) {
+      const item = document.createElement("li");
+      item.textContent = `${event.kind} ${event.workers} worker${event.workers === 1 ? "" : "s"}: ${event.reason}`;
+      workerlist.append(item);
+    }
+    workerbox.append(workerlist);
+    environmentsroot.append(workerbox);
+  }
+  if (view.urls.length > 0) {
+    const urlbox = document.createElement("details");
+    urlbox.className = "sessiongroup";
+    const urlsummary = document.createElement("summary");
+    urlsummary.textContent = `Url history of the open run (${view.urls.length})`;
+    urlbox.append(urlsummary);
+    const urllist = document.createElement("ol");
+    urllist.className = "audit";
+    for (const entry of view.urls) {
+      const item = document.createElement("li");
+      item.textContent = `${new Date(entry.at).toLocaleTimeString()} ${entry.url} (step ${entry.stepid})`;
+      urllist.append(item);
+    }
+    urlbox.append(urllist);
+    environmentsroot.append(urlbox);
+  }
+  const locksbox = document.createElement("details");
+  locksbox.className = "sessiongroup";
+  const lockssummary = document.createElement("summary");
+  lockssummary.textContent = `Run locks (${view.locks.length})`;
+  locksbox.append(lockssummary);
+  if (view.locks.length === 0) {
+    const none = document.createElement("p");
+    none.textContent = "No session holds a run lock; one session never carries two concurrent runs.";
+    locksbox.append(none);
+  }
+  const locklist = document.createElement("ul");
+  locklist.className = "audit";
+  for (const lock of view.locks) {
+    const item = document.createElement("li");
+    item.textContent = `Session ${lock.sessionid} \u2192 run ${lock.runid} (${lock.holder})${lock.expiresat !== void 0 ? ` \xB7 expires ${new Date(lock.expiresat).toLocaleTimeString()}` : " \xB7 no expiry"}`;
+    locklist.append(item);
+  }
+  locksbox.append(locklist);
+  environmentsroot.append(locksbox);
+}
 function renderagents(context) {
   if (!agentsroot) return;
   agentsroot.replaceChildren();
@@ -6430,4 +6975,31 @@ function renderagents(context) {
     agentsroot.append(eventbox);
   }
 }
+{
+  let sandboxframe;
+  chrome.runtime.onMessage.addListener((message, _sender, sendresponse) => {
+    if (!message || message.kind !== "environments" || message.action !== "sandboxhost" || !message.render?.nonce) return false;
+    try {
+      if (!sandboxframe) {
+        sandboxframe = document.createElement("iframe");
+        sandboxframe.src = chrome.runtime.getURL("sandbox.html");
+        sandboxframe.style.display = "none";
+        sandboxframe.setAttribute("aria-hidden", "true");
+        document.body.append(sandboxframe);
+      }
+      sandboxframe.contentWindow?.postMessage({ channel: "devthinksandbox", type: "render", nonce: message.render.nonce, markup: message.render.markup ?? "" }, "*");
+      const waitfor = (event) => {
+        const data = event.data;
+        if (data?.channel !== "devthinksandbox" || data.type !== "renderresult" || data.nonce !== message.render?.nonce) return;
+        window.removeEventListener("message", waitfor);
+        sendresponse({ ok: data.ok !== false, text: data.text ?? "", summary: data.summary ?? "The sandbox frame returned its render result." });
+      };
+      window.addEventListener("message", waitfor);
+      return true;
+    } catch {
+      sendresponse({ ok: false, text: "", summary: "The sandbox host could not open the sandboxed page." });
+      return true;
+    }
+  });
+}
 //# sourceMappingURL=sidepanel.js.map