my-provider-dash-manager 0.10.1 → 0.12.0

package/README.md

@@ -218,7 +218,11 @@ works in the app. Anything else can be added by URL or as a plugin.
   refused, and a fill that cannot happen now says why instead of failing quietly.
 - **Re-importing updates changed passwords** instead of silently keeping the old one.
 - **Imports existing passwords** from installed Chromium browsers (Chrome, Edge, Brave, Vivaldi,
-  Opera) or from a CSV exported by any browser, including Firefox.
+  Opera) **and from Firefox profiles directly** — no CSV export first. The *Import from browser*
+  window lists every Firefox profile that has saved logins alongside the Chromium ones. A Firefox
+  profile with a **master password** set, or one from Firefox 62 or earlier, is refused with a
+  specific message instead of importing nothing quietly; both cases point you at the CSV route. A
+  CSV exported by any browser still imports too.
 - Encrypted at rest with Windows DPAPI. Passwords never reach the app's own UI process.
 - **Origin-bound**: a login is tied to the account *and* the service's own domains. A password typed on
   another site reached from that tab (an OAuth hand-off, a look-alike page) is never captured as that
@@ -251,6 +255,14 @@ encrypted with DPAPI, revocable in one click, and never leave the main process.
   session, costing roughly 2 MB per open account. Dark Reader's browser extension cannot run in
   Electron (its background worker needs APIs Electron does not expose, and its content script
   would touch the page's own JavaScript), so the engine is bundled and driven directly.
+- **Per-account overrides (new in 0.11.0).** Open an account's gear window and each control has a
+  three-way choice: *Follow the app-wide setting* (the default), *Always on for this account*, or
+  *Always off for this account*. An override works **in both directions** — an account can keep
+  blocking ads or stay dark while the app-wide toggle is off, and vice versa — and applies at once to
+  that account's open tab. Only turning ad-block **off** reloads that one tab, because the injected
+  hide-ads style can't be retracted any other way; dark mode and switching ad-block on never reload,
+  and no other account's tab is ever reloaded. Accounts that override anything are marked
+  **content: custom** on their Home card, and an account with no override behaves exactly as before.
 
 ### Extensibility
 - **Add any service by URL** — it gets its own rail row and isolated per-account sessions.
@@ -369,11 +381,11 @@ npm start              # run the app
 npm run smoke          # sessions, registry, partitions, tab navigation (12 checks)
 npm run smoke:restore  # sessions survive a restart (real cookies)
 npm run smoke:tokens   # DPAPI round-trip + live fake-token rejection per provider (15)
-npm run smoke:creds    # import, per-account/manager/site lists, defaults, copy, fill fallback, auto-fill plan, encryption at rest (50)
+npm run smoke:creds    # import (CSV + direct Firefox), per-account/manager/site lists, defaults, copy, fill fallback, auto-fill plan, encryption at rest (56)
 npm run smoke:autofill # real page: form detection, fill + request ids, undo, capture, origin guard (15)
 npm run smoke:updates  # version comparison, silent-install mode, auto-update toggle, real release-feed check (11)
 npm run smoke:services # every built-in login page loads inside an isolated partition (42)
-npm run smoke:dark     # Dark Reader darkens a white page, stays out of the page's own JS, re-injects after navigation (9)
+npm run smoke:dark     # Dark Reader darkens a white page, stays out of the page's own JS, re-injects after navigation; per-account ad-block/dark overrides (26)
 npm run capture        # screenshot the running shell (--capture-out, --capture-open svc::id, --capture-js)
 npm run spike          # memory benchmark
 npm run dist           # build the Windows installer locally
@@ -382,7 +394,7 @@ npm start -- --print-paths            # show the app name, version and data fold
 npm start -- --open vercel::personal  # open an account on launch
 ```
 
-The suite is 156 checks across eight modes. `MAM_USER_DATA=<dir>` points any command at an isolated
+The suite is 179 checks across eight modes. `MAM_USER_DATA=<dir>` points any command at an isolated
 profile.
 
 Releases are cut by pushing a `v*` tag: GitHub Actions checks the tag against `package.json`, builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-provider-dash-manager",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "CLI to install and update My Provider Dash Manager: a free Windows desktop app that keeps many accounts per service (Vercel, Netlify, Supabase, Cloudflare, AWS, Google, Microsoft, GitHub, Gmail) signed in at once, each in a fully isolated session. Also available as mpdm.",
   "main": "src/main.js",
   "scripts": {

package/src/main.js

@@ -349,6 +349,123 @@ function autoFillPlan(svc, id, url, opts = {}) {
   return { kind: 'skip', reason: choices.length ? 'unresolved' : 'no-login' };
 }
 
+// ---------- per-account content settings (0.11.0) ----------
+// Ad-block and dark mode have ONE app-wide toggle each (Home) and were read from store.settings at
+// every apply site. An account may now carry a sparse `contentOverride: { adBlock?: 'on'|'off',
+// darkMode?: 'on'|'off' }`: ONLY the keys the user changed exist, so an untouched account's stored
+// record is byte-identical to before (measured: the sparse shape is the only one that round-trips
+// byte-identically; `{}` and null-filled shapes leave bytes behind). 'follow' is encoded as the
+// ABSENT key, which is what updateContentOverride() enforces.
+const CONTENT_NAMES = ['adBlock', 'darkMode'];
+const CONTENT_VALUES = ['on', 'off', 'follow'];
+
+// Modelled on autoFillPlan: pure, dependency-injected via `settings`, exported for smoke. The
+// follow branch is derived from settings[name] — never a hardcoded default — so a future change to
+// the app-wide default flows through every untouched account with no code change here.
+function resolveContent(acc, name, settings) {
+  const v = acc && acc.contentOverride ? acc.contentOverride[name] : undefined;
+  if (v === 'on') return true;
+  if (v === 'off') return false;
+  return !!(settings || store.settings)[name];
+}
+// Sparse write: set the key when overridden, DELETE it on 'follow', and delete the whole object when
+// it becomes empty. Nothing is written when the value is unchanged (so a no-op save touches no bytes).
+function updateContentOverride(acc, name, value) {
+  if (!CONTENT_NAMES.includes(name)) throw new Error(`unknown content setting: ${name}`);
+  if (!CONTENT_VALUES.includes(value)) throw new Error(`invalid content value: ${value}`);
+  if (value === 'follow') {
+    if (acc.contentOverride) { delete acc.contentOverride[name]; if (!Object.keys(acc.contentOverride).length) delete acc.contentOverride; }
+    return;
+  }
+  if (!acc.contentOverride) acc.contentOverride = {};
+  acc.contentOverride[name] = value;
+}
+function contentOverrideFor(acc) {
+  return { adBlock: !!(acc && acc.contentOverride && acc.contentOverride.adBlock), darkMode: !!(acc && acc.contentOverride && acc.contentOverride.darkMode) };
+}
+
+// The two per-view react sites, in ONE place so the global toggle and a per-account override change
+// cannot drift apart. `before`/`after` are resolved pairs; only a control whose value MOVED is acted
+// on, so a tab that resolves the same is untouched (the equality bar for un-overridden accounts):
+//   - dark: enable/disable in that view's isolated world, no reload (measured: it restores exactly).
+//   - adBlock -> on: the network predicate is already live through its per-request closure, so only
+//     the cosmetic CSS needs re-applying.
+//   - adBlock -> off: injected CSS cannot be retracted (src/content.js is frozen and applyToPage
+//     discards its insertCSS key), so that ONE view reloads. Never any other view.
+function applyContentChange(t, before, after) {
+  const wc = t.view.webContents;
+  if (!wc || wc.isDestroyed() || !before) return;
+  if (before.darkMode !== after.darkMode) { if (after.darkMode) dark.enable(wc); else dark.disable(wc); }
+  if (before.adBlock !== after.adBlock) {
+    if (after.adBlock) content.applyToPage(wc, { adBlock: true });
+    else wc.reload();
+  }
+}
+
+// The did-finish-load apply for ONE document. A fresh document has no dark engine yet, so "off"
+// needs no disable call; the cosmetic layer is applied only when resolved on (applyToPage itself
+// also skips managed dashboards, invariant 5 — unchanged).
+function applyContentToFreshDocument(wc, acc) {
+  content.applyToPage(wc, { adBlock: resolveContent(acc, 'adBlock', store.settings) });
+  if (resolveContent(acc, 'darkMode', store.settings)) dark.enable(wc);
+}
+// Re-resolve every live tab and act only where the value moved. `snapshot` maps tab key -> resolved
+// pair captured BEFORE the change; a tab with no snapshot is left alone (it was created inside this
+// same change, and its own did-finish-load path already used the new values).
+function reactToContentChange(vm, snapshot) {
+  for (const t of vm.tabs.values()) {
+    const acc = findAccount(t.svc, t.id);
+    const after = { adBlock: resolveContent(acc, 'adBlock', store.settings), darkMode: resolveContent(acc, 'darkMode', store.settings) };
+    applyContentChange(t, snapshot.get(accountKey(t.svc, t.id)), after);
+  }
+}
+function contentSnapshot(vm) {
+  const snap = new Map();
+  for (const [key, t] of vm.tabs) {
+    const acc = findAccount(t.svc, t.id);
+    snap.set(key, { adBlock: resolveContent(acc, 'adBlock', store.settings), darkMode: resolveContent(acc, 'darkMode', store.settings) });
+  }
+  return snap;
+}
+
+// The body of the account-content-override IPC, exported so smoke drives the REAL path (the
+// setOrClearDefault precedent). Validates, writes sparse, applies live, emits once.
+function setAccountContentOverride(vm, svc, id, name, value) {
+  const acc = findAccount(svc, id);
+  if (!acc) throw new Error('unknown account');
+  if (!CONTENT_NAMES.includes(name)) throw new Error(`unknown content setting: ${name}`);
+  if (!CONTENT_VALUES.includes(value)) throw new Error(`invalid content value: ${value}`);
+  const snapshot = contentSnapshot(vm);
+  updateContentOverride(acc, name, value);
+  store.save();
+  reactToContentChange(vm, snapshot);
+  vm.emitState();
+  return {
+    value: (acc.contentOverride && acc.contentOverride[name]) || 'follow',
+    override: contentOverrideFor(acc),
+    resolved: { adBlock: resolveContent(acc, 'adBlock', store.settings), darkMode: resolveContent(acc, 'darkMode', store.settings) },
+  };
+}
+
+// The app-wide toggle's body, exported for smoke the same way (set-content-setting delegates here).
+// 0.11.0: capture what every live tab resolves to BEFORE the change, so the reaction can skip any
+// tab whose account overrides the control (its resolved value does not move) — for an account with
+// no override this is exactly today's behaviour, tab for tab.
+function setGlobalContentSetting(vm, name, value) {
+  if (!['adBlock', 'darkMode', 'saveLogins', 'autofill', 'autoUpdate'].includes(name)) throw new Error(`unknown setting: ${name}`);
+  const snapshot = (name === 'darkMode' || name === 'adBlock') ? contentSnapshot(vm) : null;
+  store.settings[name] = !!value;
+  if (name === 'autoUpdate') { store.save(); updater.setAutoUpdate(!!value); vm.emitState(); return !!value; }
+  store.save();
+  if (snapshot) {
+    // dark: one enable/disable call per affected view — no reload. ad-block: cosmetics re-apply on,
+    // and only a view whose RESOLVED value fell to off reloads (injected CSS has no other undo).
+    reactToContentChange(vm, snapshot);
+  }
+  vm.emitState();
+  return store.settings[name];
+}
+
 // ---------- view manager ----------
 class ViewManager {
   constructor() {
@@ -494,7 +611,7 @@ class ViewManager {
       ses.setPermissionRequestHandler((_wc, permission, cb) => cb(ALLOWED.has(permission)));
       ses.setPermissionCheckHandler((_wc, permission, _origin) => ALLOWED.has(permission));
     }
-    content.attachAdBlock(ses, () => !!store.settings.adBlock); // network-level ad/tracker blocking per partition
+    content.attachAdBlock(ses, () => resolveContent(acc, 'adBlock', store.settings)); // per-partition network blocking, resolved PER REQUEST (the account is captured, never scanned — 0.11.0)
     if (acc && acc.proxy) this.applyProxy(view.webContents.session, acc.proxy);
     return view;
   }
@@ -533,14 +650,14 @@ class ViewManager {
       if (input.type === 'keyDown' && input.key === 'Escape' && !this.modalOpen) this.deactivate();
     });
     view.webContents.on('did-finish-load', () => {
-      content.applyToPage(view.webContents, { adBlock: !!store.settings.adBlock });
-      // Enable dark mode once the document's styles exist. did-navigate fires too early: the
-      // dynamic engine finds no stylesheets to transform yet, so enabling there leaves the page
-      // white. This fires again after every cross-origin navigation, which is exactly what the
-      // isolated-world reset requires — the world (and Dark Reader in it) is gone by then and must
-      // be re-injected. Same-document (pushState) routing never reaches here, so it never re-injects.
-      if (store.settings.darkMode) dark.enable(view.webContents);
-      // A full load can land on a different host than did-navigate reported (client-side redirects):
+      // Ad-block cosmetics + dark mode, resolved for THIS account (0.11.0). Enable dark mode once the
+      // document's styles exist: did-navigate fires too early — the dynamic engine finds no
+      // stylesheets to transform yet, so enabling there leaves the page white. This fires again after
+      // every cross-origin navigation, which is exactly what the isolated-world reset requires — the
+      // world (and Dark Reader in it) is gone by then and must be re-injected. Same-document
+      // (pushState) routing never reaches here, so it never re-injects. A fresh document never has an
+      // engine, so "resolved off" needs no disable call.
+      applyContentToFreshDocument(view.webContents, acc);
       // refresh the address strip's key chip from the URL that actually finished loading (0.10.0).
       this.emitState();
     });
@@ -733,6 +850,10 @@ class ViewManager {
         status: statusCache.get(accountKey(a.svc, a.id)) || null,
         loginCount: accountLoginSummaries(a.svc, a.id, loginList).length, // "has saved login" indicator
         noAutoFill: !!a.noAutoFill,
+        // 0.11.0: what each control ACTUALLY resolves to for this account, and whether the account
+        // overrides it — the gear window's worded state and the Home card's marker read these.
+        contentResolved: { adBlock: resolveContent(a, 'adBlock', store.settings), darkMode: resolveContent(a, 'darkMode', store.settings) },
+        contentOverridden: contentOverrideFor(a),
       })), // live registry projection for the home grid (token presence + status summaries; never raw tokens)
       groupTabs: !!store.settings.groupTabs,
       collapsed: store.settings.collapsed || [],
@@ -1277,6 +1398,130 @@ async function runSmokeCreds() {
   } finally {
     try { fs.rmSync(csv, { force: true }); } catch {}
   }
+
+  // ---------- 0.12.0: direct Firefox import ----------
+  // Every fixture here is built from published test constants by scripts/firefox-fixture.js. The
+  // import is NEVER pointed at the real %APPDATA%\Mozilla\Firefox profile: the profile LIST is
+  // redirected with MAM_FIREFOX_ROOT and every read uses an explicit synthetic folder.
+  try {
+    const { build: buildFixture, KNOWN_WEB } = require('../scripts/firefox-fixture.js');
+    // The suite owns the whole temp dir and asserts it holds nothing but fixture INPUTS afterwards:
+    // a written decrypt is the one way this path could hand plaintext to disk.
+    const ffTmp = path.join(app.getPath('temp'), `mam-ff-${process.pid}`);
+    fs.rmSync(ffTmp, { recursive: true, force: true });
+    fs.mkdirSync(ffTmp, { recursive: true });
+    try {
+    const profilesRoot = path.join(ffTmp, 'ffroot');
+    const profileDir = path.join(profilesRoot, 'Profiles', 'synthetic.default-release');
+    buildFixture(profileDir);
+    // A second profile with only key4.db, and the UTF-16LE-BOM profiles.ini Firefox really writes.
+    const key4OnlyDir = path.join(profilesRoot, 'Profiles', 'empty.default');
+    fs.mkdirSync(key4OnlyDir, { recursive: true });
+    fs.copyFileSync(path.join(profileDir, 'key4.db'), path.join(key4OnlyDir, 'key4.db'));
+    const iniText = '[General]\r\nStartWithLastProfile=1\r\nVersion=2\r\n\r\n'
+      + '[Profile0]\r\nName=synthetic\r\nIsRelative=1\r\nPath=Profiles/synthetic.default-release\r\nDefault=1\r\n\r\n'
+      + '[Profile1]\r\nName=empty\r\nIsRelative=1\r\nPath=Profiles/empty.default\r\n';
+    fs.writeFileSync(path.join(profilesRoot, 'profiles.ini'), Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(iniText, 'utf16le')]));
+
+    process.env.MAM_FIREFOX_ROOT = profilesRoot;
+    let listed = [];
+    try { listed = creds.listFirefoxProfiles(); } finally { delete process.env.MAM_FIREFOX_ROOT; }
+
+    // (1) the profile list and the synthetic round trip in one check: the UTF-16LE profiles.ini is
+    // read correctly, a key4.db-only profile does NOT appear as importable, and the import recovers
+    // exactly the known rows with Unicode and embedded commas intact. The blank-username row and the
+    // chrome:// row are both skipped and both counted.
+    const profile = { browser: 'Firefox', profile: 'synthetic.default-release', profileDir };
+    const r1 = creds.importFromFirefox(profile);
+    const all = creds.loadAll().filter(c => String(c.source).startsWith('Firefox:'));
+    const want = new Map(KNOWN_WEB.map(k => [creds.hostOf(k.hostname), k]));
+    check('firefox-synthetic-import',
+      listed.length === 1 && listed[0].browser === 'Firefox'
+        && listed[0].profile === 'synthetic.default-release' && listed[0].profileDir === path.resolve(profileDir)
+        && r1.refused == null && r1.added === 4 && r1.updated === 0 && r1.scanned === 6
+        && r1.skippedBlank === 1 && r1.skippedNonWeb === 1
+        && all.length === 4
+        && all.every(c => { const w = want.get(c.host); return w && w.password === c.password && w.username === c.username; })
+        && all.some(c => c.password === 'p@ss"word,with,commas')
+        && all.some(c => c.password === 'パスワード–✓' && c.username === 'üser@example.test')
+        && all.every(c => c.source === 'Firefox: synthetic.default-release' && !!c.importedAt),
+      `listed=${listed.map(p => p.profile).join(',') || 'none'} added=${r1.added} scanned=${r1.scanned} blank=${r1.skippedBlank} nonWeb=${r1.skippedNonWeb}`);
+
+    // (2) the frozen merge contract: a re-import with ONE changed password updates in place, keeps
+    // the id, and does not add a row.
+    const before = creds.loadAll().filter(c => String(c.source).startsWith('Firefox:'));
+    const targetRow = before.find(c => c.username === 'alice@example.test');
+    const targetId = targetRow.id;
+    // Rebuild the fixture, changing only alice's password, then re-import the same profile label.
+    buildFixture(profileDir, { passwordOverrides: { 'alice@example.test': 'S3cret-Beta2!' } });
+    const r2 = creds.importFromFirefox(profile);
+    const afterRows = creds.loadAll().filter(c => String(c.source).startsWith('Firefox:'));
+    const aliceAfter = afterRows.find(c => c.username === 'alice@example.test');
+    check('firefox-in-place-merge',
+      r2.updated === 1 && r2.added === 0 && aliceAfter && aliceAfter.id === targetId
+        && aliceAfter.password === 'S3cret-Beta2!' && afterRows.length === 4,
+      `added=${r2.added} updated=${r2.updated} id-same=${!!aliceAfter && aliceAfter.id === targetId}`);
+
+    // (3) at rest: the raw store must not contain any fixture password (it is DPAPI-encrypted).
+    const rawStore = fs.readFileSync(path.join(app.getPath('userData'), 'credentials.json'), 'utf8');
+    const secrets = [...KNOWN_WEB.map(k => k.password), 'S3cret-Beta2!', 'only-password', 'not-a-web-login'];
+    check('firefox-encrypted-at-rest',
+      secrets.every(s => !rawStore.includes(s)) && rawStore.includes('"ct"'),
+      `${secrets.length} fixture secrets absent; store is ${rawStore.length} B of ciphertext`);
+
+    // (4) refusal 1: an empty folder — honest error, zero rows added.
+    const emptyDir = path.join(ffTmp, 'empty-profile');
+    fs.mkdirSync(emptyDir, { recursive: true });
+    const countBefore = creds.stats().total;
+    const r3 = creds.importFromFirefox({ browser: 'Firefox', profile: 'empty-profile', profileDir: emptyDir });
+    check('firefox-refused-missing-profile',
+      r3.added === 0 && r3.refused === 'FIREFOX_NO_KEY4' && /key4\.db/.test(r3.note || '')
+        && creds.stats().total === countBefore,
+      `refused=${r3.refused} added=${r3.added} "${String(r3.note).slice(0, 70)}"`);
+
+    // (5) refusal 2: a flipped ciphertext byte in key4.db — honest error, zero rows added.
+    const corruptDir = path.join(ffTmp, 'corrupt-profile');
+    fs.mkdirSync(corruptDir, { recursive: true });
+    buildFixture(corruptDir);
+    {
+      const { DatabaseSync } = require('node:sqlite');
+      const db = new DatabaseSync(path.join(corruptDir, 'key4.db'));
+      const meta = db.prepare("SELECT item2 FROM metaData WHERE id='password'").get();
+      const blob = Buffer.from(meta.item2);
+      blob[blob.length - 1] ^= 0xff; // one byte of the password-check ciphertext
+      db.prepare("UPDATE metaData SET item2=? WHERE id='password'").run(blob);
+      db.close();
+    }
+    const countBefore2 = creds.stats().total;
+    const r4 = creds.importFromFirefox({ browser: 'Firefox', profile: 'corrupt-profile', profileDir: corruptDir });
+    check('firefox-refused-corrupt-fixture',
+      r4.added === 0 && r4.refused === 'FIREFOX_MASTER_PASSWORD' && /master password|damaged/.test(r4.note || '')
+        && creds.stats().total === countBefore2,
+      `refused=${r4.refused} added=${r4.added} "${String(r4.note).slice(0, 70)}"`);
+
+    // (6) non-web hosts are counted, never stored: the store holds no `chrome` host, AND the import
+    // left nothing plaintext in the temp dir — every file there is a fixture input, and its only
+    // output is the DPAPI-encrypted store.
+    const storedRows = creds.loadAll().filter(c => String(c.source).startsWith('Firefox:'));
+    const leftFiles = [];
+    const walk = dir => { for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      const f = path.join(dir, e.name);
+      if (e.isDirectory()) walk(f); else leftFiles.push(path.relative(ffTmp, f));
+    } };
+    walk(ffTmp);
+    const nonFixture = leftFiles.filter(f => !/(^|[\\/])(key4\.db|logins\.json|profiles\.ini)$/.test(f));
+    check('firefox-skips-non-web-hosts',
+      r1.skippedNonWeb === 1
+        && !storedRows.some(c => c.host === 'chrome' || c.host === 'chrome://settings')
+        && !creds.listCredentials().some(c => c.host === 'chrome')
+        && storedRows.every(c => /^[a-z0-9.-]+$/.test(c.host) && !c.host.includes(':'))
+        && nonFixture.length === 0,
+      `skippedNonWeb=${r1.skippedNonWeb}; hosts=${storedRows.map(c => c.host).join(',')}; temp=${leftFiles.length} files all fixture inputs${nonFixture.length ? ` (unexpected: ${nonFixture.join(',')})` : ''}`);
+    } finally { fs.rmSync(ffTmp, { recursive: true, force: true }); }
+  } catch (err) {
+    check('exception:firefox', false, err.message);
+  }
+
   fs.writeFileSync(path.join(__dirname, '..', 'smoke-report.json'), JSON.stringify(results, null, 2));
   app.exit(results.checks.every(c => c.ok) ? 0 : 1);
 }
@@ -1475,6 +1720,245 @@ async function runSmokeDark() {
   const bgNav = await bgOf();
   check('re-darkens-after-cross-origin-navigation', !!bgNav && !/255,\s*255,\s*255/.test(bgNav), bgNav);
 
+  // ================= 0.11.0: PER-ACCOUNT CONTENT SETTINGS =================
+  // The nine checks above are the pre-0.11.0 goldens and stay untouched (no assertion edited). This
+  // section is additive: dark overrides (5), ad-block (6 — the first ad-block coverage this suite
+  // has ever had), then the data/API contracts (4).
+  //
+  // Every check runs offline: the dark checks use two local white pages, and the ad-block checks use
+  // a seed-listed ad host that CANNOT resolve. With the blocker on the request dies as
+  // net::ERR_BLOCKED_BY_CLIENT (-20); with it off the same request dies as net::ERR_NAME_NOT_RESOLVED
+  // (-105) — measured on this machine against the repo's real src/content.js before this was written.
+  // The two codes are therefore a real, network-free witness of the network-layer decision.
+  const isDark = bg => !!bg && bg !== '' && !/255,\s*255,\s*255/.test(bg);
+  const isWhite = bg => /255,\s*255,\s*255/.test(bg || '');
+
+  // A fresh account + a fresh white document, loaded through the REAL create path so the real
+  // did-finish-load apply (and the real per-request closure in makeView) is what gets measured.
+  const mk = async (id, url) => {
+    vm.create('vercel', id, url, { show: false });
+    const t = vm.tabs.get(accountKey('vercel', id));
+    // create() calls loadURL without waiting, so either the load is still in flight or it already
+    // finished (a cached file:// page) — never wait for an event that has already fired.
+    if (t.view.webContents.isLoading()) await new Promise(r => t.view.webContents.once('did-finish-load', r));
+    return t;
+  };
+  const bgOfTab = async t => {
+    try { return await t.view.webContents.executeJavaScript(`getComputedStyle(document.documentElement).backgroundColor`); } catch { return ''; }
+  };
+  const engineOf = async t => {
+    try { return await t.view.webContents.executeJavaScriptInIsolatedWorld(dark.DARK_WORLD_ID, [{ code: 'typeof window.DarkReader' }]); } catch { return undefined; }
+  };
+
+  // Reset the registry and the global settings this section depends on, then build a control view
+  // with NO overrides at all (the equality baseline every per-account assertion compares against).
+  store.accounts = store.accounts.filter(a => a.svc !== 'vercel' || !/^x-/.test(a.id));
+  store.settings.darkMode = true; store.settings.adBlock = true;
+  const control = await mk('x-control', toUrl(p1));
+  await sleep(3200);
+  const controlDark = await bgOfTab(control);
+  const controlEngine = await engineOf(control);
+
+  // 1. global ON, A override off, B follows -> A white, B dark.
+  registerAccount('vercel', 'x-a');
+  updateContentOverride(findAccount('vercel', 'x-a'), 'darkMode', 'off');
+  const aOff = await mk('x-a', toUrl(p1));
+  const bFollowOn = await mk('x-b', toUrl(p1));
+  await sleep(3200);
+  const aOffBg = await bgOfTab(aOff); const bOnBg = await bgOfTab(bFollowOn);
+  check('per-account-dark-override-off-while-global-on', isWhite(aOffBg) && isDark(bOnBg), `A=${aOffBg} B=${bOnBg}`);
+
+  // 2. global OFF, A override on, B follows -> A dark, B white (Q2: true override, both directions).
+  store.settings.darkMode = false;
+  const cOff = await mk('x-c', toUrl(p1));
+  registerAccount('vercel', 'x-d');
+  updateContentOverride(findAccount('vercel', 'x-d'), 'darkMode', 'on');
+  const dOn = await mk('x-d', toUrl(p1));
+  await sleep(3200);
+  const cOffBg = await bgOfTab(cOff); const dOnBg = await bgOfTab(dOn);
+  check('per-account-dark-override-on-while-global-off', isDark(dOnBg) && isWhite(cOffBg), `C(global-off)=${cOffBg} D(override-on)=${dOnBg}`);
+
+  // 3. follow-global is byte-for-byte the control view: same computed colour AND same engine presence.
+  store.settings.darkMode = true;
+  const follow = await mk('x-e', toUrl(p1));
+  await sleep(3200);
+  const followBg = await bgOfTab(follow); const followEngine = await engineOf(follow);
+  check('per-account-dark-follow-global',
+    followBg === controlDark && followEngine === controlEngine && followEngine === 'object',
+    `follow=${followBg}/${followEngine} control=${controlDark}/${controlEngine}`);
+
+  // 4. override change applies to the OPEN document with no reload: the h1 keeps an in-page marker
+  //    (a reload would drop it), while the colour returns to white. B (untouched) keeps its colour.
+  await follow.view.webContents.executeJavaScript(`document.querySelector('h1').setAttribute('data-marker','kept')`).catch(() => {});
+  const bBefore4 = await bgOfTab(bFollowOn);
+  setAccountContentOverride(vm, 'vercel', 'x-e', 'darkMode', 'off');
+  await sleep(1800);
+  const marker = await follow.view.webContents.executeJavaScript(`document.querySelector('h1') && document.querySelector('h1').getAttribute('data-marker')`).catch(() => null);
+  const followBg4 = await bgOfTab(follow); const bAfter4 = await bgOfTab(bFollowOn);
+  check('per-account-override-change-applies-without-reload',
+    followBg4 !== '' && isWhite(followBg4) && marker === 'kept' && bAfter4 === bBefore4,
+    `marker=${marker} bg=${followBg4} B before/after=${bBefore4}/${bAfter4}`);
+
+  // 5. an untouched account is unchanged by a sibling's override: compare a following tab with the
+  //    control view created before ANY override existed.
+  const untouched = await mk('x-f', toUrl(p1));
+  await sleep(3200);
+  const untouchedBg = await bgOfTab(untouched); const untouchedEngine = await engineOf(untouched);
+  check('per-account-dark-untouched-account-unchanged',
+    untouchedBg === controlDark && untouchedEngine === controlEngine,
+    `untouched=${untouchedBg}/${untouchedEngine} control=${controlDark}/${controlEngine}`);
+
+  // ---------- ad-block: the offline ERR_BLOCKED_BY_CLIENT / ERR_NAME_NOT_RESOLVED discriminator ----------
+  // A seed-listed ad host whose SUBDOMAIN cannot resolve. hostBlocked() walks parent domains, so it
+  // is blocked by the predicate, while DNS guarantees the "not blocked" answer is a different code.
+  const ADHOST = 'mam011-smoke-no-such-host.doubleclick.net';
+  const frameCode = async t => {
+    const wc = t.view.webContents;
+    const got = await new Promise(resolve => {
+      const seen = [];
+      const onFail = (_e, code, desc, _vurl, isMainFrame) => { if (!isMainFrame) seen.push(desc); };
+      wc.on('did-fail-load', onFail);
+      wc.executeJavaScript(`(() => { const old = document.getElementById('mam-ad-probe'); if (old) old.remove();
+        const f = document.createElement('iframe'); f.id = 'mam-ad-probe';
+        f.src = 'https://${ADHOST}/ad.html'; document.body.appendChild(f); return f.src; })()`).catch(() => {});
+      setTimeout(() => { wc.removeListener('did-fail-load', onFail); resolve(seen); }, 6000);
+    });
+    return got[0] || 'none';
+  };
+  // A fresh document is what makes the check independent of earlier iframes: reload once, then probe.
+  const reloadAndProbe = async t => {
+    const wc = t.view.webContents;
+    await new Promise(r => { wc.once('did-finish-load', r); wc.reload(); });
+    await sleep(600);
+    return frameCode(t);
+  };
+
+  // 6. global ON, A override off, B follows -> A is NOT blocked, B IS blocked.
+  store.settings.adBlock = true;
+  registerAccount('vercel', 'x-g');
+  updateContentOverride(findAccount('vercel', 'x-g'), 'adBlock', 'off');
+  const gOff = await mk('x-g', toUrl(p1));
+  await sleep(800);
+  const gCode = await reloadAndProbe(gOff);
+  const bCode = await reloadAndProbe(bFollowOn);
+  check('per-account-adblock-override-off-while-global-on',
+    gCode === 'ERR_NAME_NOT_RESOLVED' && bCode === 'ERR_BLOCKED_BY_CLIENT', `G(override-off)=${gCode} B(follow)=${bCode}`);
+
+  // 7. global OFF, D override on (D already exists with a dark override), E follows -> D blocked, C not.
+  store.settings.adBlock = false;
+  updateContentOverride(findAccount('vercel', 'x-d'), 'adBlock', 'on');
+  const dCode = await reloadAndProbe(dOn);
+  const cCode2 = await reloadAndProbe(cOff);
+  check('per-account-adblock-override-on-while-global-off',
+    dCode === 'ERR_BLOCKED_BY_CLIENT' && cCode2 === 'ERR_NAME_NOT_RESOLVED', `D(override-on)=${dCode} C(global-off)=${cCode2}`);
+
+  // 8. follow-global: an un-overridden account produces exactly the code the global dictates. With
+  //    the global back on, that is BLOCKED — the same answer the control view would give.
+  store.settings.adBlock = true;
+  const fCode = await reloadAndProbe(follow); // x-e has only a darkMode override: adBlock follows
+  check('per-account-adblock-follow-global', fCode === 'ERR_BLOCKED_BY_CLIENT', `E(follow, global on)=${fCode}`);
+
+  // 9. a LIVE flip changes the next request's outcome with no reload: x-g is overridden off; clearing
+  //    the override (it follows the on global) blocks the SAME host, in the SAME document. A page
+  //    marker proves the document survived — a URL comparison alone would NOT, because a reload keeps
+  //    the URL (mutation 4 caught exactly that: it reloaded on the on-flip and still passed).
+  await gOff.view.webContents.executeJavaScript(`window.__mamFlipMark = 'alive'`).catch(() => {});
+  const urlBefore9 = gOff.view.webContents.getURL();
+  setAccountContentOverride(vm, 'vercel', 'x-g', 'adBlock', 'follow');
+  await sleep(400);
+  const gCodeLive = await frameCode(gOff);
+  const urlAfter9 = gOff.view.webContents.getURL();
+  const flipMark = await gOff.view.webContents.executeJavaScript(`window.__mamFlipMark || 'gone'`).catch(() => 'gone');
+  check('adblock-live-flip-no-reload',
+    gCodeLive === 'ERR_BLOCKED_BY_CLIENT' && urlBefore9 === urlAfter9 && flipMark === 'alive',
+    `after=${gCodeLive} url ${urlBefore9 === urlAfter9 ? 'unchanged' : 'CHANGED'} document=${flipMark}`);
+
+  // 10. cosmetic per account: applyToPage hides the ad slot for an on-account and leaves it for an
+  //     off-account. The seed list carries no generic cosmetics (they come from a fetched EasyList),
+  //     so the check installs ONE known selector into the live filter set for the duration of the
+  //     assertion and restores it in a finally — the module's bytes are untouched (it is frozen), and
+  //     the check then measures the real did-finish-load apply for two accounts that resolve
+  //     differently. `display:none` vs `display:block` is the observable.
+  const cosFile = path.join(app.getPath('temp'), 'mam-content-cosmetic.html');
+  fs.writeFileSync(cosFile, '<!doctype html><html><head><style>#ad-slot{display:block;height:10px;width:10px}</style></head><body><div id="ad-slot"></div><h1>probe</h1></body></html>');
+  const savedCosmetic = content.filters.cosmetic;
+  content.filters.cosmetic = ['#ad-slot'];
+  let cosOn = ''; let cosOff = ''; let cosOffTab = null;
+  try {
+    const onT = await mk('x-h', toUrl(cosFile));
+    await sleep(900);
+    cosOn = await onT.view.webContents.executeJavaScript(`getComputedStyle(document.getElementById('ad-slot')).display`).catch(() => '');
+    registerAccount('vercel', 'x-i');
+    updateContentOverride(findAccount('vercel', 'x-i'), 'adBlock', 'off');
+    const offT = await mk('x-i', toUrl(cosFile));
+    await sleep(900);
+    cosOff = await offT.view.webContents.executeJavaScript(`getComputedStyle(document.getElementById('ad-slot')).display`).catch(() => '');
+    cosOffTab = offT; // used by check 11 below
+  } finally { content.filters.cosmetic = savedCosmetic; }
+  check('adblock-cosmetic-per-account', cosOn === 'none' && cosOff === 'block',
+    `following(adBlock on)=${cosOn} overridden-off=${cosOff}`);
+
+  // 11. a reload caused by ANOTHER account's ad-block change never reaches this account's document.
+  //     Toggling the GLOBAL off and back on makes every FOLLOWING account's resolved value move
+  //     (off, then on: the "on" half re-applies cosmetics, the "off" half reloads), while x-i is
+  //     overridden off and resolves `false` at both points — so it must not reload. A page-global
+  //     marker survives a non-reload and dies on a reload.
+  const offTab = cosOffTab;
+  await gOff.view.webContents.executeJavaScript(`window.__mamMark = 'alive'`).catch(() => {});
+  await offTab.view.webContents.executeJavaScript(`window.__mamMark = 'alive'`).catch(() => {});
+  setGlobalContentSetting(vm, 'adBlock', false);
+  await sleep(500);
+  setGlobalContentSetting(vm, 'adBlock', true);
+  await sleep(2000);
+  const gMark = await gOff.view.webContents.executeJavaScript(`window.__mamMark || 'gone'`).catch(() => 'gone');
+  const iMark = await offTab.view.webContents.executeJavaScript(`window.__mamMark || 'gone'`).catch(() => 'gone');
+  check('adblock-off-account-unaffected-by-other-accounts-reload', gMark === 'gone' && iMark === 'alive',
+    `following(${gMark}) overridden-off(${iMark})`);
+
+  // ---------- data / API contracts ----------
+  // 12. sparse storage: setting one key never creates the other, and clearing deletes the key.
+  registerAccount('vercel', 'x-j');
+  setAccountContentOverride(vm, 'vercel', 'x-j', 'adBlock', 'off');
+  const jAcc = findAccount('vercel', 'x-j');
+  check('content-override-stored-sparse',
+    JSON.stringify(jAcc.contentOverride) === JSON.stringify({ adBlock: 'off' }),
+    JSON.stringify(jAcc.contentOverride));
+
+  // 13. the owner's bar, mechanically: set then clear leaves accounts.json byte-identical.
+  const accFile = path.join(app.getPath('userData'), 'accounts.json');
+  registerAccount('vercel', 'x-k');
+  const before13 = fs.readFileSync(accFile);
+  setAccountContentOverride(vm, 'vercel', 'x-k', 'darkMode', 'on');
+  setAccountContentOverride(vm, 'vercel', 'x-k', 'darkMode', 'follow');
+  const after13 = fs.readFileSync(accFile);
+  check('content-override-clear-is-byte-identical', before13.equals(after13),
+    `${before13.length} vs ${after13.length} bytes; key present after clear: ${'contentOverride' in findAccount('vercel', 'x-k')}`);
+
+  // 14. the IPC rejects an unknown name and an unknown account (mirrors account-no-autofill).
+  const throws = fn => { try { fn(); return false; } catch { return true; } };
+  check('content-override-rejects-unknown-name', throws(() => setAccountContentOverride(vm, 'vercel', 'x-j', 'network', 'on')));
+  check('content-override-rejects-unknown-account', throws(() => setAccountContentOverride(vm, 'vercel', 'nobody', 'adBlock', 'on')));
+  // 15. only on / off / follow are accepted — and nothing is written when the value is refused.
+  const jBefore = JSON.stringify(findAccount('vercel', 'x-j').contentOverride);
+  check('content-override-invalid-value-rejected',
+    throws(() => setAccountContentOverride(vm, 'vercel', 'x-j', 'adBlock', 'yes'))
+      && JSON.stringify(findAccount('vercel', 'x-j').contentOverride) === jBefore,
+    `stored=${jBefore}`);
+
+  // ---------- the resolver contract (MUTATION-PLUS) ----------
+  // The follow path must be derived from the GLOBAL, never a hardcoded literal. The spec's own
+  // formula is `!!settings[name]`, so the returned value is the global's truthiness — not the raw
+  // value (a string fake therefore reads `true`, and asserting raw identity would be asserting
+  // against the contract). What a literal default cannot do is FOLLOW the global in both directions:
+  // a resolver hardcoded to true fails the first half, one hardcoded to false fails the second.
+  const followOn = resolveContent({}, 'adBlock', { adBlock: true });
+  const followOff = resolveContent({ contentOverride: {} }, 'adBlock', { adBlock: false });
+  const followUnset = resolveContent({}, 'darkMode', {});
+  const followOverridden = resolveContent({ contentOverride: { adBlock: 'on' } }, 'adBlock', { adBlock: false });
+  check('resolver-follow-tracks-the-global-not-a-literal',
+    followOn === true && followOff === false && followUnset === false && followOverridden === true,
+    `global true->${followOn}, global false->${followOff}, unset->${followUnset}, override-on-over-global-off->${followOverridden}`);
+
   fs.writeFileSync(path.join(__dirname, '..', 'smoke-report.json'), JSON.stringify(results, null, 2));
   app.exit(results.checks.every(c => c.ok) ? 0 : 1);
 }
@@ -1634,6 +2118,72 @@ function runInteractive(captureMode = false) {
           console.log('[capture] demo notice:', plan.kind, (plan.choices || []).length);
           await new Promise(r => setTimeout(r, 700));
         }
+        // --demo-home-marker: give two demo accounts one override each through the REAL path, so the
+        // Home grid shows the "content: custom" marker the way a user would see it (0.11.0).
+        if (process.argv.includes('--demo-home-marker')) {
+          try {
+            if (findAccount('vercel', 'work')) setAccountContentOverride(vm, 'vercel', 'work', 'darkMode', 'off');
+            if (findAccount('netlify', 'agency')) setAccountContentOverride(vm, 'netlify', 'agency', 'adBlock', 'on');
+          } catch (err) { console.error('[demo] home marker failed:', err.message); }
+          vm.emitState();
+          await new Promise(r => setTimeout(r, 800));
+          const info = await win.webContents.executeJavaScript(`JSON.stringify([...document.querySelectorAll('.card .contentcustom')].map(m => {
+            const r = m.getBoundingClientRect();
+            return m.closest('.card').querySelector('.label').innerText + ' :: ' + m.innerText + ' @' + Math.round(r.x) + ',' + Math.round(r.y);
+          }))`).catch(err => 'probe failed: ' + err.message);
+          console.log('[capture] home markers:', info);
+          await new Promise(r => setTimeout(r, 300));
+        }
+        // --demo-import: open the Import-from-browser window through the RENDERER's own click
+        // handler, so the screenshot shows the real modal with whatever profile rows exist. Point
+        // MAM_FIREFOX_ROOT at a synthetic root first and the Firefox row is the fixture, never the
+        // owner's live profile. Screenshot aid for a scratch demo profile, like --demo-picker.
+        if (process.argv.includes('--demo-import')) {
+          await new Promise(r => setTimeout(r, 600));
+          if (win.webContents && !win.webContents.isDestroyed()) {
+            await win.webContents.executeJavaScript('document.getElementById("imp-browser").click()').catch(err => console.error('[capture] import click failed:', err.message));
+          }
+          await new Promise(r => setTimeout(r, 1200));
+          const info = await win.webContents.executeJavaScript(`JSON.stringify({
+            modalOpen: !document.getElementById('modal-back').hidden,
+            rows: [...document.querySelectorAll('#modal [data-imp]')].map(b => b.innerText.trim()),
+            note: (() => { const n = [...document.querySelectorAll('#modal .note')].find(x => /master password/.test(x.textContent)); return n ? n.textContent.trim().slice(0, 90) : ''; })(),
+          })`).catch(err => 'probe failed: ' + err.message);
+          console.log('[capture] demo import:', info);
+        }
+        // --demo-content: give the account in --capture-open one override through the REAL path, then
+        // open its gear window from the RENDERER, so the screenshot shows the real three-way selects,
+        // the worded resolved state and the honest note (0.11.0). Drives state from main, never from
+        // --capture-js (which intermittently exits 127 on this machine). Scratch demo profile only.
+        if (process.argv.includes('--demo-content') && openKey) {
+          const [dsvc, did] = openKey.split('::');
+          try { setAccountContentOverride(vm, dsvc, did, 'darkMode', 'off'); } catch (err) { console.error('[demo] content override failed:', err.message); }
+          vm.emitState();
+          await new Promise(r => setTimeout(r, 500));
+          if (win.webContents && !win.webContents.isDestroyed()) {
+            await win.webContents.executeJavaScript(`document.querySelector('[data-gear="${openKey}"]') && document.querySelector('[data-gear="${openKey}"]').click()`).catch(err => console.error('[demo] gear click failed:', err.message));
+          }
+          await new Promise(r => setTimeout(r, 900));
+          const info = await win.webContents.executeJavaScript(`JSON.stringify({
+            modalOpen: !document.getElementById('modal-back').hidden,
+            selects: [...document.querySelectorAll('#modal select')].map(s => ({ id: s.id, value: s.value, options: s.options.length })),
+            states: [...document.querySelectorAll('#modal .contentctl .note')].map(n => n.textContent.trim()),
+            note: (() => { const ns = [...document.querySelectorAll('#modal .note')]; const n = ns.find(x => /both directions/.test(x.textContent)); return n ? n.textContent.trim().slice(0, 120) : ''; })(),
+          })`).catch(err => 'probe failed: ' + err.message);
+          console.log('[capture] demo content:', info);
+          // drive one select through the REAL renderer → preload → main chain and read the store back
+          const realPath = await win.webContents.executeJavaScript(`(async () => {
+            const sel = document.getElementById('m-content-adBlock');
+            const before = sel.value;
+            sel.value = 'off'; sel.dispatchEvent(new Event('change', { bubbles: true }));
+            await new Promise(r => setTimeout(r, 900));
+            return JSON.stringify({ before, after: sel.value, stateLine: document.getElementById('m-content-adBlock-state').textContent.trim() });
+          })()`).catch(err => 'real-path probe failed: ' + err.message);
+          console.log('[capture] demo content real path:', realPath, 'stored:', JSON.stringify((findAccount(openKey.split('::')[0], openKey.split('::')[1]) || {}).contentOverride));
+          // scroll the modal to its end so the honest note under the selects is in frame
+          await win.webContents.executeJavaScript(`(() => { const m = document.getElementById('modal'); if (m) m.scrollTop = m.scrollHeight; return m ? m.scrollTop : -1; })()`).catch(() => {});
+          await new Promise(r => setTimeout(r, 400));
+        }
         // --demo-picker: open the address-strip key chip's picker from MAIN (state → emitState → the
         // renderer's own click handler), so a screenshot shows the real popover and not hand-written
         // DOM. The chip is drawn from state.siteLogins, so one emitState is enough. Verification aid
@@ -2005,7 +2555,13 @@ function runInteractive(captureMode = false) {
     return { ok: false, reason: result.reason, message: messages[result.reason] || 'This page has no visible password field to fill.' };
   });
   ipcMain.handle('creds-stats', () => creds.stats());
-  ipcMain.handle('creds-browsers', () => creds.listChromiumProfiles().map(p => ({ browser: p.browser, profile: p.profile, id: p.loginData })));
+  // One list, two kinds: a Chromium profile and a Firefox profile are both "a browser profile with
+  // saved logins", so the existing Import-from-browser window renders them side by side with no new
+  // surface. `kind` is what tells the renderer which import handler to call.
+  ipcMain.handle('creds-browsers', () => [
+    ...creds.listChromiumProfiles().map(p => ({ browser: p.browser, profile: p.profile, id: p.loginData, kind: 'chromium' })),
+    ...creds.listFirefoxProfiles().map(p => ({ browser: p.browser, profile: p.profile, id: p.profileDir, kind: 'firefox' })),
+  ]);
   ipcMain.handle('creds-import-browser', async (_e, id) => {
     const p = creds.listChromiumProfiles().find(x => x.loginData === id);
     if (!p) throw new Error('Browser profile not found');
@@ -2013,6 +2569,16 @@ function runInteractive(captureMode = false) {
     vm.emitState();
     return r;
   });
+  // Firefox: refuses a master-password-protected or old-format profile with a specific message and
+  // imports nothing. A refusal is a normal result here, not an exception, so the window can show it.
+  ipcMain.handle('creds-import-firefox', (_e, profileDir) => {
+    const p = creds.listFirefoxProfiles().find(x => x.profileDir === profileDir)
+      || (profileDir ? { browser: 'Firefox', profile: path.basename(String(profileDir)), profileDir } : null);
+    if (!p) throw new Error('Firefox profile not found');
+    const r = creds.importFromFirefox(p);
+    vm.emitState();
+    return r;
+  });
   ipcMain.handle('creds-import-csv', async () => {
     const { dialog } = require('electron');
     const r = await dialog.showOpenDialog({ title: 'Import passwords from CSV', filters: [{ name: 'CSV', extensions: ['csv'] }], properties: ['openFile'] });
@@ -2071,6 +2637,14 @@ function runInteractive(captureMode = false) {
     vm.emitState();
     return acc.noAutoFill;
   });
+  // Per-account content override (0.11.0): 'follow' | 'on' | 'off' per control, stored SPARSELY on
+  // the account record (see updateContentOverride). 'follow' deletes the key, so clearing restores
+  // the account's stored bytes. An override is a TRUE override in both directions (owner decision
+  // Q2): it may turn a control on while the app-wide toggle is off, and vice versa. The change is
+  // applied to that account's live tab immediately; every other tab is re-resolved and acted on only
+  // if ITS value actually moved (an untouched account is never reloaded or re-engaged).
+  ipcMain.handle('account-content-override', (_e, svc, id, name, value) =>
+    setAccountContentOverride(vm, svc, id, name, value));
   // Dismiss the per-tab notice (banner X).
   ipcMain.handle('dismiss-notice', (_e, key) => { vm.setNotice(key, null); return true; });
   // Undo an auto-fill: the preload clears exactly what it filled and answers with what it cleared.
@@ -2173,31 +2747,7 @@ function runInteractive(captureMode = false) {
     vm.emitState();
     return true;
   });
-  ipcMain.handle('set-content-setting', (_e, name, value) => {
-    if (!['adBlock', 'darkMode', 'saveLogins', 'autofill', 'autoUpdate'].includes(name)) throw new Error(`unknown setting: ${name}`);
-    store.settings[name] = !!value;
-    if (name === 'autoUpdate') { store.save(); updater.setAutoUpdate(!!value); vm.emitState(); return !!value; }
-    store.save();
-    if (name === 'darkMode') {
-      // The engine runs in each view's isolated world, so a flip is one enable/disable call per
-      // live tab — no reload. The previous extension path forced a reload of every open tab, which
-      // threw away scroll position and anything typed into a half-filled form.
-      const on = !!value;
-      for (const t of vm.tabs.values()) {
-        if (on) dark.enable(t.view.webContents);
-        else dark.disable(t.view.webContents);
-      }
-    } else if (name === 'adBlock') {
-      // the network layer flips live through its closure; cosmetic CSS needs a re-apply on, and a
-      // reload off (injected CSS can only be undone by reloading)
-      for (const t of vm.tabs.values()) {
-        if (value) content.applyToPage(t.view.webContents, { adBlock: true });
-        else t.view.webContents.reload();
-      }
-    }
-    vm.emitState();
-    return store.settings[name];
-  });
+  ipcMain.handle('set-content-setting', (_e, name, value) => setGlobalContentSetting(vm, name, value));
   ipcMain.handle('content-stats', () => ({
     blocked: content.stats.blocked,
     listSource: content.filters.loadedFrom,
@@ -2291,6 +2841,8 @@ function runInteractive(captureMode = false) {
 module.exports = {
   accountLoginSummaries, managerRows, setOrClearDefault, resolveAmong, fillCandidatesFor, autoFillPlan,
   originAllowed, accountKey,
+  resolveContent, updateContentOverride, contentOverrideFor,
+  setAccountContentOverride, setGlobalContentSetting, applyContentToFreshDocument, reactToContentChange, contentSnapshot,
   _creds: creds,
 };