diff --git a/AGENTS.md b/AGENTS.md
index 0154bec2..578d6b0d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -63,6 +63,8 @@ donutbrowser/
 │   │   ├── mcp_toolsets.rs          # Optional MCP toolsets: which tools a client lists (core + opt-in sets)
 │   │   ├── mcp_views.rs             # Compact MCP views: profile summaries, filters, paging, size caps
 │   │   ├── navigation_watch.rs      # Whether a CDP action navigated, so a click waits only for a load that comes
+│   │   ├── network_capture.rs       # MCP network capture: one browser-level socket per profile, in memory, credentials redacted
+│   │   ├── agent_uploads.rs         # Files an agent sends to file_upload, kept until the browser stops
 │   │   ├── mcp_remote.rs            # Remote MCP bridge: outbound websocket to Donut cloud (Enterprise remote control)
 │   │   ├── mcp_integrations.rs      # 20-client MCP installer: remote endpoint with bearer, format-preserving JSONC/TOML edits
 │   │   ├── automation_rate_limiter.rs # Shared REST/MCP automation quota
diff --git a/e2e/tests/browser.test.mjs b/e2e/tests/browser.test.mjs
index e4222cb8..61079dad 100644
--- a/e2e/tests/browser.test.mjs
+++ b/e2e/tests/browser.test.mjs
@@ -871,6 +871,205 @@ test("real Wayfern fingerprinting, terms, API automation, CDP, cookies, and proc
       "yes",
     );
 
+    // Form tools on a native select and a hidden file input added to the page.
+    const toolError = async (name, args = {}) => {
+      const response = await fetch(`${base}/v1/e2e/mcp`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${saved.api_token}`,
+          "content-type": "application/json",
+          "mcp-session-id": mcpSession,
+        },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: ++rpcId,
+          method: "tools/call",
+          params: { name, arguments: { profile_id: profile.id, ...args } },
+        }),
+      });
+      const answer = await response.json();
+      assert.ok(answer.body.error, JSON.stringify(answer.body));
+      return answer.body.error;
+    };
+    await cdp.evaluate(`(() => {
+      const form = document.createElement('form');
+      form.innerHTML = '<label for="fixture-country">Country</label>'
+        + '<select id="fixture-country"><option value="">Pick one</option>'
+        + '<option value="de">Germany</option><option value="fr">France</option></select>'
+        + '<select id="fixture-langs" multiple><option value="en">English</option>'
+        + '<option value="de">German</option></select>'
+        + '<label id="fixture-upload-label">Attach'
+        + '<input id="fixture-file" type="file" style="display: none"></label>';
+      document.body.prepend(form);
+      const country = form.querySelector('#fixture-country');
+      country.addEventListener('change', () => { country.dataset.changed = country.value; });
+      form.querySelector('#fixture-file').addEventListener('change', (event) => {
+        event.target.dataset.trusted = String(event.isTrusted);
+      });
+      return true;
+    })()`);
+    const picked = await toolJson("select_option", {
+      selector: "#fixture-country",
+      option: "France",
+    });
+    assert.deepEqual(
+      picked.selected.map((option) => option.value),
+      ["fr"],
+      JSON.stringify(picked),
+    );
+    assert.equal(picked.changed, true);
+    assert.equal(
+      await cdp.evaluate(
+        "document.querySelector('#fixture-country').dataset.changed",
+      ),
+      "fr",
+    );
+    const byLocator = await toolJson("select_option", {
+      locator: { attributes: [{ name: "id", value: "fixture-country" }] },
+      option: "de",
+    });
+    assert.equal(byLocator.selected[0].label, "Germany");
+    const unchanged = await toolJson("select_option", {
+      selector: "#fixture-country",
+      option: "Germany",
+    });
+    assert.equal(unchanged.changed, false);
+    const both = await toolJson("select_option", {
+      selector: "#fixture-langs",
+      options: ["English", "de"],
+    });
+    assert.deepEqual(
+      both.selected.map((option) => option.value),
+      ["en", "de"],
+    );
+    const noSuchOption = await toolError("select_option", {
+      selector: "#fixture-country",
+      option: "Mars",
+    });
+    assert.match(noSuchOption.message, /No option matches.*Germany/s);
+    const notSelect = await toolError("select_option", {
+      selector: "#fixture-button",
+      option: "x",
+    });
+    assert.match(notSelect.message, /not a <select>/);
+
+    const uploaded = await toolJson("file_upload", {
+      selector: "#fixture-upload-label",
+      files: [{ name: "notes.txt", text: "Donut upload" }],
+    });
+    assert.deepEqual(uploaded.files, [{ name: "notes.txt", bytes: 12 }]);
+    assert.equal(
+      await cdp.evaluate(
+        "document.querySelector('#fixture-file').files[0].text()",
+      ),
+      "Donut upload",
+    );
+    assert.equal(
+      await cdp.evaluate(
+        "document.querySelector('#fixture-file').dataset.trusted",
+      ),
+      "true",
+      "the page sees the files arrive as a person's pick",
+    );
+    const replaced = await toolJson("file_upload", {
+      selector: "#fixture-file",
+      files: [
+        {
+          name: "bytes.bin",
+          content_base64: Buffer.from([0, 1, 2]).toString("base64"),
+        },
+      ],
+    });
+    assert.deepEqual(replaced.files, [{ name: "bytes.bin", bytes: 3 }]);
+    const stagedUploads = path.join(
+      app.dataRoot,
+      "cache",
+      "agent-uploads",
+      profile.id,
+    );
+    assert.equal(existsSync(stagedUploads), true);
+    const oneFileOnly = await toolError("file_upload", {
+      selector: "#fixture-file",
+      files: [
+        { name: "a.txt", text: "a" },
+        { name: "b.txt", text: "b" },
+      ],
+    });
+    assert.match(oneFileOnly.message, /takes one file/);
+
+    // Network capture: what the page fetches, with its bodies and without its
+    // credentials, and nothing while the person holds the profile.
+    const capture = await toolJson("start_network_capture");
+    assert.equal(capture.capturing, true, JSON.stringify(capture));
+    assert.ok(capture.tabs >= 1, JSON.stringify(capture));
+    assert.equal(
+      (await toolJson("start_network_capture")).already_running,
+      true,
+    );
+    const echoBody = JSON.stringify({ hello: "capture" });
+    await cdp.evaluate(
+      `fetch('/api/echo?capture=1', { method: 'POST', headers: { 'content-type': 'application/json', authorization: 'Bearer e2e-secret' }, body: ${JSON.stringify(echoBody)} }).then((response) => response.text())`,
+    );
+    const echoed = await app.waitFor(
+      async () => {
+        const listed = await toolJson("list_network_requests", {
+          url_contains: "/api/echo?capture=1",
+        });
+        const entry = listed.requests[0];
+        return entry?.body === "kept" ? entry : null;
+      },
+      { timeoutMs: 10_000, description: "the captured echo request" },
+    );
+    assert.equal(echoed.method, "POST");
+    assert.equal(echoed.status, 200);
+    assert.equal(echoed.type, "Fetch");
+    const captured = await toolJson("get_network_request", {
+      request_id: echoed.id,
+    });
+    assert.equal(captured.post_data, echoBody);
+    assert.equal(JSON.parse(captured.body.text).body, echoBody);
+    const header = (headers, name) =>
+      Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+    assert.equal(
+      header(captured.request_headers, "authorization"),
+      "[redacted]",
+    );
+    const setCookie = header(captured.response_headers, "set-cookie");
+    assert.ok(setCookie === undefined || setCookie === "[redacted]", setCookie);
+    const byBody = await toolJson("list_network_requests", {
+      body_contains: "CAPTURE",
+      type: "fetch",
+    });
+    assert.ok(
+      byBody.requests.some((entry) => entry.id === echoed.id),
+      JSON.stringify(byBody),
+    );
+    await app.invoke("take_over_profile", {
+      profileId: profile.id,
+      note: null,
+    });
+    await cdp.evaluate(
+      "fetch('/api/echo?while-held=1').then((response) => response.text())",
+    );
+    // The capture reads the browser's events on its own task.
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    await app.invoke("hand_back_profile", {
+      profileId: profile.id,
+      note: null,
+    });
+    const whileHeld = await toolJson("list_network_requests", {
+      url_contains: "while-held",
+    });
+    assert.equal(whileHeld.requests.length, 0, JSON.stringify(whileHeld));
+    assert.ok(whileHeld.withheld >= 1, JSON.stringify(whileHeld));
+    assert.equal((await toolJson("stop_network_capture")).stopped, true);
+    assert.equal(
+      (await toolError("list_network_requests")).data.code,
+      "NETWORK_CAPTURE_NOT_RUNNING",
+    );
+    // Left running, so the browser's stop is what ends it.
+    await toolJson("start_network_capture");
+
     const shot = await tool("screenshot");
     assert.equal(shot.mimeType, "image/jpeg");
     const jpeg = Buffer.from(shot.data, "base64");
@@ -968,6 +1167,15 @@ test("real Wayfern fingerprinting, terms, API automation, CDP, cookies, and proc
     cdp.close();
     cdp = null;
     await waitForProcessExit(app, browserPid);
+    assert.equal(
+      existsSync(stagedUploads),
+      false,
+      "an agent's uploads go with the browser",
+    );
+    assert.equal(
+      (await toolError("list_network_requests")).data.code,
+      "NETWORK_CAPTURE_NOT_RUNNING",
+    );
     const stoppedProfile = (await app.invoke("list_browser_profiles")).find(
       (item) => item.id === profile.id,
     );
diff --git a/src-tauri/src/agent_console.rs b/src-tauri/src/agent_console.rs
index 9e3224e6..e872361d 100644
--- a/src-tauri/src/agent_console.rs
+++ b/src-tauri/src/agent_console.rs
@@ -394,6 +394,13 @@ fn targeted_profiles(arguments: &serde_json::Value) -> Vec<String> {
   ids
 }
 
+/// Whether the person has paused every agent or taken over this profile, so
+/// what happens in it now is theirs.
+pub fn person_in_control(profile_id: &str) -> bool {
+  let state = console();
+  state.paused.is_some() || state.holds.contains_key(profile_id)
+}
+
 /// `passive` tools (reads and the human tools) are never refused.
 pub fn check_call(passive: bool, arguments: &serde_json::Value) -> Result<(), Refusal> {
   refusal_for(&console(), passive, arguments)
diff --git a/src-tauri/src/agent_uploads.rs b/src-tauri/src/agent_uploads.rs
new file mode 100644
index 00000000..38b4c54f
--- /dev/null
+++ b/src-tauri/src/agent_uploads.rs
@@ -0,0 +1,183 @@
+//! Files an agent hands to `file_upload`, written where the browser can read
+//! them.
+//!
+//! The page reads an uploaded file when it sends the form or reads the file,
+//! which can be long after the call, so each copy stays until the profile's
+//! browser stops. An ephemeral profile's copies stay in its memory-backed
+//! directory; startup removes whatever an earlier run left.
+
+use std::path::{Path, PathBuf};
+
+/// The most bytes one call may upload. A call arrives as one JSON-RPC message
+/// of at most 1 MiB, and base64 grows the bytes by a third.
+pub const MAX_UPLOAD_BYTES: usize = 700 * 1024;
+/// The most files one call may upload.
+pub const MAX_UPLOAD_FILES: usize = 10;
+const MAX_NAME_BYTES: usize = 200;
+/// The folder inside an ephemeral profile's directory.
+const EPHEMERAL_FOLDER: &str = ".donut-agent-uploads";
+
+/// One file to put in a file input.
+#[derive(Debug, Clone, PartialEq)]
+pub struct UploadFile {
+  pub name: String,
+  pub bytes: Vec<u8>,
+}
+
+fn root() -> PathBuf {
+  crate::app_dirs::cache_dir().join("agent-uploads")
+}
+
+fn profile_root(profile_id: &str) -> PathBuf {
+  match crate::ephemeral_dirs::get_ephemeral_dir(profile_id) {
+    Some(dir) => dir.join(EPHEMERAL_FOLDER),
+    None => root().join(profile_id),
+  }
+}
+
+/// The name a file is uploaded under: the last part of `name`, with
+/// characters no file system takes replaced. `None` when nothing usable is
+/// left or it is too long.
+pub fn clean_name(name: &str) -> Option<String> {
+  let last = name.rsplit(['/', '\\']).next().unwrap_or_default();
+  let cleaned: String = last
+    .chars()
+    .filter(|c| !c.is_control())
+    .map(|c| match c {
+      '<' | '>' | ':' | '"' | '|' | '?' | '*' => '_',
+      c => c,
+    })
+    .collect();
+  let cleaned = cleaned.trim().trim_end_matches('.').trim_end();
+  if cleaned.is_empty()
+    || cleaned.trim_start_matches('.').is_empty()
+    || cleaned.len() > MAX_NAME_BYTES
+  {
+    return None;
+  }
+  Some(cleaned.to_string())
+}
+
+fn create_private_dir(dir: &Path) -> std::io::Result<()> {
+  std::fs::create_dir_all(dir)?;
+  #[cfg(unix)]
+  {
+    use std::os::unix::fs::PermissionsExt;
+    std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o700))?;
+  }
+  Ok(())
+}
+
+/// Write `files` to a new folder of the profile's, and answer their paths in
+/// the same order.
+pub fn stage(profile_id: &str, files: &[UploadFile]) -> std::io::Result<Vec<PathBuf>> {
+  let base = profile_root(profile_id);
+  create_private_dir(&base)?;
+  let dir = base.join(uuid::Uuid::new_v4().to_string());
+  create_private_dir(&dir)?;
+  files
+    .iter()
+    .map(|file| {
+      let path = dir.join(&file.name);
+      std::fs::write(&path, &file.bytes)?;
+      Ok(path)
+    })
+    .collect()
+}
+
+/// Remove every file staged for a profile.
+pub fn remove_for_profile(profile_id: &str) {
+  let dir = profile_root(profile_id);
+  match std::fs::remove_dir_all(&dir) {
+    Ok(()) => log::debug!("Agent uploads removed profile={profile_id}"),
+    Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+    Err(e) => log::warn!("Agent uploads removal failed profile={profile_id} err=\"{e}\""),
+  }
+}
+
+/// Remove the files of every profile `running` says is stopped.
+pub fn sweep(running: impl Fn(&str) -> bool) {
+  let Ok(entries) = std::fs::read_dir(root()) else {
+    return;
+  };
+  for entry in entries.flatten() {
+    let name = entry.file_name().to_string_lossy().to_string();
+    if !running(&name) {
+      let _ = std::fs::remove_dir_all(entry.path());
+    }
+  }
+}
+
+/// Remove what an earlier run left.
+pub fn clear_all() {
+  match std::fs::remove_dir_all(root()) {
+    Ok(()) => log::info!("Removed agent uploads from an earlier run"),
+    Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+    Err(e) => log::warn!("Agent uploads cleanup failed err=\"{e}\""),
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn a_name_keeps_its_last_part_and_loses_what_a_file_system_refuses() {
+    assert_eq!(clean_name("resume.pdf").as_deref(), Some("resume.pdf"));
+    assert_eq!(clean_name("../../etc/passwd").as_deref(), Some("passwd"));
+    assert_eq!(
+      clean_name("C:\\Users\\a\\photo.jpg").as_deref(),
+      Some("photo.jpg")
+    );
+    assert_eq!(clean_name("a:b?.txt").as_deref(), Some("a_b_.txt"));
+    assert_eq!(clean_name(" report.csv\n").as_deref(), Some("report.csv"));
+    assert_eq!(clean_name("name.").as_deref(), Some("name"));
+    assert_eq!(clean_name(".env").as_deref(), Some(".env"));
+    for refused in ["", "..", ".", "dir/", "   ", "\u{0}"] {
+      assert_eq!(clean_name(refused), None, "{refused:?}");
+    }
+    assert_eq!(clean_name(&"a".repeat(MAX_NAME_BYTES + 1)), None);
+  }
+
+  #[test]
+  fn staged_files_hold_their_bytes_until_the_profile_is_cleared() {
+    let cache = tempfile::tempdir().unwrap();
+    let _guard = crate::app_dirs::set_test_cache_dir(cache.path().to_path_buf());
+    let profile = "11111111-2222-3333-4444-555555555555";
+    let files = [
+      UploadFile {
+        name: "a.txt".to_string(),
+        bytes: b"first".to_vec(),
+      },
+      UploadFile {
+        name: "b.bin".to_string(),
+        bytes: vec![0, 1, 2],
+      },
+    ];
+    let paths = stage(profile, &files).unwrap();
+    assert_eq!(std::fs::read(&paths[0]).unwrap(), b"first");
+    assert_eq!(std::fs::read(&paths[1]).unwrap(), vec![0, 1, 2]);
+    assert_eq!(paths[0].file_name().unwrap(), "a.txt");
+    assert!(paths[0].starts_with(root().join(profile)));
+    #[cfg(unix)]
+    {
+      use std::os::unix::fs::PermissionsExt;
+      let mode = std::fs::metadata(paths[0].parent().unwrap())
+        .unwrap()
+        .permissions()
+        .mode();
+      assert_eq!(mode & 0o777, 0o700);
+    }
+
+    let other = "99999999-2222-3333-4444-555555555555";
+    stage(other, &files[..1]).unwrap();
+    sweep(|id| id == other);
+    assert!(!root().join(profile).exists());
+    assert!(root().join(other).exists());
+    remove_for_profile(other);
+    assert!(!root().join(other).exists());
+    stage(other, &files[..1]).unwrap();
+    clear_all();
+    assert!(!root().exists());
+  }
+}
diff --git a/src-tauri/src/browser_runner.rs b/src-tauri/src/browser_runner.rs
index 6f817703..f36f62af 100644
--- a/src-tauri/src/browser_runner.rs
+++ b/src-tauri/src/browser_runner.rs
@@ -1445,6 +1445,8 @@ impl BrowserRunner {
       crate::extension_manager::ExtensionManager::cleanup_unpacked_for_profile(
         &profile.id.to_string(),
       );
+      crate::agent_uploads::remove_for_profile(&profile.id.to_string());
+      crate::network_capture::stop(&profile.id.to_string());
 
       // A temporary profile exists for one automation run, so the run ending
       // is what ends it. Destroyed rather than trashed: nothing here is worth
diff --git a/src-tauri/src/cdp_target.rs b/src-tauri/src/cdp_target.rs
index 0d741335..c6220de1 100644
--- a/src-tauri/src/cdp_target.rs
+++ b/src-tauri/src/cdp_target.rs
@@ -260,6 +260,29 @@ async fn local_cdp_port(profile: &BrowserProfile, patience: Patience) -> Option<
   None
 }
 
+/// A BROWSER-level socket on a locally running browser, for a client that
+/// attaches to every tab itself. `None` when the profile's browser is not
+/// running on this machine.
+pub async fn connect_local_browser(profile: &BrowserProfile) -> Option<CdpConnection> {
+  profile.process_id?;
+  let port = local_cdp_port(profile, Patience::Immediate).await?;
+  let version: Value = reqwest::Client::new()
+    .get(format!("http://127.0.0.1:{port}/json/version"))
+    .timeout(Duration::from_secs(3))
+    .send()
+    .await
+    .ok()?
+    .json()
+    .await
+    .ok()?;
+  let request = version
+    .get("webSocketDebuggerUrl")
+    .and_then(Value::as_str)?
+    .into_client_request()
+    .ok()?;
+  dial(request, None).await.ok().map(CdpConnection::new)
+}
+
 /// A page-level socket on a locally running browser.
 ///
 /// Returns `None` rather than an error: a miss is how the resolver decides the
@@ -396,8 +419,26 @@ impl CdpConnection {
     method: &str,
     params: Value,
   ) -> Result<(), CdpError> {
-    use futures_util::sink::SinkExt;
     let frame = cdp_frame(self.cdp_session.as_deref(), id, method, params);
+    self.send_frame(frame).await
+  }
+
+  /// Send `method` as command `id` to the flattened session `session`, or to
+  /// the socket's own target when it is `None`.
+  pub async fn send_to(
+    &mut self,
+    session: Option<&str>,
+    id: u64,
+    method: &str,
+    params: Value,
+  ) -> Result<(), CdpError> {
+    self
+      .send_frame(cdp_frame(session, id, method, params))
+      .await
+  }
+
+  async fn send_frame(&mut self, frame: Value) -> Result<(), CdpError> {
+    use futures_util::sink::SinkExt;
     self
       .stream
       .send(Message::Text(frame.to_string().into()))
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 38ac9b68..4dd48b06 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -144,6 +144,7 @@ mod window_decorations;
 // mod theme_detector; // removed: theme detection handled in webview via CSS prefers-color-scheme
 mod agent_console;
 mod agent_schedules;
+mod agent_uploads;
 mod cloud_api;
 pub mod cloud_auth;
 mod cloud_errors;
@@ -159,6 +160,7 @@ mod mcp_server;
 mod mcp_toolsets;
 mod mcp_views;
 mod navigation_watch;
+mod network_capture;
 mod tag_manager;
 pub mod team_activity;
 mod team_lock;
@@ -3014,6 +3016,9 @@ pub fn run_with_builder(
       // only, so it runs in every mode, e2e included.
       profile::trash::start_expiry_sweeper();
 
+      // Files staged for an agent's upload are kept until the browser stops.
+      crate::agent_uploads::clear_all();
+
       // A temporary profile is destroyed when its browser stops. One that
       // outlived a crash has nothing left to stop it, so startup does.
       {
diff --git a/src-tauri/src/mcp_server.rs b/src-tauri/src/mcp_server.rs
index 99d6995e..99584b4b 100644
--- a/src-tauri/src/mcp_server.rs
+++ b/src-tauri/src/mcp_server.rs
@@ -1674,7 +1674,15 @@ async fn wayfern_locate(
     Err(WayfernError::NoMatch { .. }) => {}
     Err(other) => return Err(other.into()),
   }
+  page_locate(session, locator, candidate_limit).await
+}
 
+/// Resolve `locator` to one DOM node with the page's own resolver.
+async fn page_locate(
+  session: &mut WayfernSession,
+  locator: &LocatorDescription,
+  candidate_limit: Option<u64>,
+) -> Result<LocatedNode, AgentError> {
   let opts = serde_json::json!({
     "mode": "resolve",
     "locator": locator,
@@ -2296,6 +2304,454 @@ pub(crate) async fn agent_pick_element(
   Ok(picked?)
 }
 
+// --- Form tools: options of a select, files of a file input -----------------
+
+/// How a form tool names its element.
+enum ElementRef {
+  Selector(String),
+  /// An entry of the session's last `get_interactive_elements` listing.
+  Index {
+    cache: String,
+    index: u64,
+  },
+  Locator(LocatorDescription),
+}
+
+/// The object group a form tool's element handles live in, released when the
+/// tool is done.
+const FORM_GROUP: &str = "donut-form";
+
+/// The page's handle to the element `element` names, and the locator's match
+/// when a locator named it.
+async fn form_element(
+  session: &mut WayfernSession,
+  engine: Engine,
+  element: &ElementRef,
+) -> Result<(String, Option<LocatorCandidate>), AgentError> {
+  let (expression, missing) = match element {
+    ElementRef::Locator(locator) => {
+      let located = if engine.is_wayfern() {
+        wayfern_locate(session, locator, None).await?
+      } else {
+        page_locate(session, locator, None).await?
+      };
+      let node = session
+        .call(
+          "DOM.resolveNode",
+          serde_json::json!({
+            "backendNodeId": located.backend_node_id,
+            "objectGroup": FORM_GROUP,
+          }),
+        )
+        .await?;
+      let object = node
+        .pointer("/object/objectId")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| AgentError::Malformed("DOM.resolveNode answered no object".into()))?;
+      return Ok((object.to_string(), Some(located.matched)));
+    }
+    ElementRef::Selector(selector) => (
+      format!(
+        "document.querySelector({})",
+        serde_json::Value::from(selector.as_str())
+      ),
+      format!("No element matches selector {selector}"),
+    ),
+    ElementRef::Index { cache, index } => (
+      format!("(() => {{ const arr = window[{cache}]; return (arr && arr[{index}]) || null; }})()"),
+      format!(
+        "No element at index {index}. Call get_interactive_elements first or after navigation."
+      ),
+    ),
+  };
+  let result = session
+    .call(
+      "Runtime.evaluate",
+      serde_json::json!({
+        "expression": expression,
+        "returnByValue": false,
+        "objectGroup": FORM_GROUP,
+      }),
+    )
+    .await?;
+  if let Some(thrown) = script_exception(&result) {
+    return Err(thrown);
+  }
+  match result.pointer("/result/objectId").and_then(|v| v.as_str()) {
+    Some(object) => Ok((object.to_string(), None)),
+    None => Err(AgentError::NoMatch { message: missing }),
+  }
+}
+
+/// Run `function` on `object` and hand back what it returned.
+async fn call_on(
+  session: &mut WayfernSession,
+  object: &str,
+  function: &str,
+  arguments: serde_json::Value,
+) -> Result<serde_json::Value, AgentError> {
+  let reply = session
+    .call(
+      "Runtime.callFunctionOn",
+      serde_json::json!({
+        "objectId": object,
+        "functionDeclaration": function,
+        "arguments": arguments,
+        "returnByValue": true,
+      }),
+    )
+    .await?;
+  if let Some(thrown) = script_exception(&reply) {
+    return Err(thrown);
+  }
+  Ok(reply.pointer("/result/value").cloned().unwrap_or_default())
+}
+
+/// Pick the options a caller named in a `<select>` (or the one `<select>` a
+/// label or a container names), the way a person's pick leaves it: focused,
+/// with `input` and `change` fired when the choice changed. Answers the
+/// choice, or `{ error, ... }`.
+const SELECT_OPTION_FN: &str = r#"function (wanted) {
+  const norm = (s) => String(s == null ? '' : s).replace(/\s+/g, ' ').trim();
+  let el = this;
+  if (!(el instanceof HTMLSelectElement)) {
+    const inner = el.control instanceof HTMLSelectElement
+      ? [el.control]
+      : Array.from(el.querySelectorAll ? el.querySelectorAll('select') : []);
+    if (inner.length !== 1) {
+      return { error: 'not_select', tag: String(el.tagName || '').toLowerCase(), found: inner.length };
+    }
+    el = inner[0];
+  }
+  const options = Array.from(el.options);
+  const label = (o) => norm(o.label || o.text);
+  const describe = (o) => ({ value: o.value, label: label(o), disabled: o.disabled });
+  const find = (w) => {
+    const text = norm(w);
+    return options.find((o) => o.value === w)
+      || options.find((o) => label(o) === text)
+      || options.find((o) => label(o).toLowerCase() === text.toLowerCase());
+  };
+  const chosen = wanted.map(find);
+  const missing = wanted.filter((_, i) => !chosen[i]);
+  if (missing.length) {
+    return { error: 'no_option', missing, options: options.slice(0, 50).map(describe), count: options.length };
+  }
+  if (el.disabled) return { error: 'disabled' };
+  const off = chosen.filter((o) => o.disabled || (o.parentElement instanceof HTMLOptGroupElement && o.parentElement.disabled));
+  if (off.length) return { error: 'option_disabled', options: off.map(describe) };
+  if (chosen.length > 1 && !el.multiple) return { error: 'single' };
+  const before = options.map((o) => o.selected);
+  el.scrollIntoView({ block: 'nearest' });
+  el.focus({ preventScroll: true });
+  if (el.multiple) {
+    for (const o of options) o.selected = chosen.includes(o);
+  } else {
+    el.selectedIndex = options.indexOf(chosen[0]);
+  }
+  const changed = options.some((o, i) => o.selected !== before[i]);
+  if (changed) {
+    el.dispatchEvent(new Event('input', { bubbles: true, composed: true }));
+    el.dispatchEvent(new Event('change', { bubbles: true }));
+  }
+  return { selected: options.filter((o) => o.selected).map(describe), changed, multiple: el.multiple };
+}"#;
+
+/// What `select_option` did.
+#[derive(Debug, Serialize)]
+struct SelectedOptions {
+  selected: serde_json::Value,
+  changed: bool,
+  navigated: bool,
+  #[serde(rename = "match", skip_serializing_if = "Option::is_none")]
+  matched: Option<LocatorCandidate>,
+}
+
+/// A refusal `SELECT_OPTION_FN` answered, as an error an agent can act on.
+fn select_refusal(answer: &serde_json::Value) -> Option<AgentError> {
+  let error = answer.get("error")?.as_str()?;
+  Some(match error {
+    "not_select" => AgentError::BadRequest(format!(
+      "The element is a <{}>, not a <select>. For a custom dropdown, click it open and click the option.",
+      answer["tag"].as_str().unwrap_or("?")
+    )),
+    "no_option" => AgentError::BadRequest(format!(
+      "No option matches {}. The select has {} options: {}",
+      answer["missing"], answer["count"], answer["options"]
+    )),
+    "disabled" => AgentError::BadRequest("The select is disabled.".to_string()),
+    "option_disabled" => AgentError::BadRequest(format!(
+      "These options are disabled: {}",
+      answer["options"]
+    )),
+    "single" => AgentError::InvalidArgument(
+      "This select takes one option; name one.".to_string(),
+    ),
+    other => AgentError::Malformed(format!("the select script answered {other}")),
+  })
+}
+
+async fn agent_select_option(
+  ctx: &AgentContext,
+  element: &ElementRef,
+  wanted: &[String],
+) -> Result<SelectedOptions, AgentError> {
+  let mut session = WayfernSession::open(&ctx.target).await?;
+  let outcome = async {
+    session.call("Page.enable", serde_json::json!({})).await?;
+    let (object, matched) = form_element(&mut session, ctx.engine, element).await?;
+    let (reply, navigated) = session
+      .call_then_await_navigation(
+        "Runtime.callFunctionOn",
+        serde_json::json!({
+          "objectId": object,
+          "functionDeclaration": SELECT_OPTION_FN,
+          "arguments": [{ "value": wanted }],
+          "returnByValue": true,
+        }),
+        CLICK_LOAD_TIMEOUT,
+      )
+      .await?;
+    if let Some(thrown) = script_exception(&reply) {
+      return Err(thrown);
+    }
+    let answer = reply.pointer("/result/value").cloned().unwrap_or_default();
+    if let Some(refusal) = select_refusal(&answer) {
+      return Err(refusal);
+    }
+    Ok(SelectedOptions {
+      selected: answer["selected"].clone(),
+      changed: answer["changed"].as_bool().unwrap_or(false),
+      navigated,
+      matched,
+    })
+  }
+  .await;
+  let _ = session
+    .call(
+      "Runtime.releaseObjectGroup",
+      serde_json::json!({ "objectGroup": FORM_GROUP }),
+    )
+    .await;
+  let _ = session.call("Page.disable", serde_json::json!({})).await;
+  session.close().await;
+  outcome
+}
+
+/// The file input `this` names: itself, the input a label is for, or the one
+/// file input inside it. Answers the input, or why there is none as a string.
+const FILE_INPUT_FN: &str = r#"function () {
+  const isFile = (n) => n instanceof HTMLInputElement && n.type === 'file';
+  let el = this;
+  if (!isFile(el)) {
+    if (isFile(el.control)) {
+      el = el.control;
+    } else {
+      const inner = el.querySelectorAll ? el.querySelectorAll('input[type=file]') : [];
+      if (inner.length !== 1) return inner.length ? 'many' : 'none:' + String(el.tagName || '').toLowerCase();
+      el = inner[0];
+    }
+  }
+  if (el.disabled) return 'disabled';
+  return el;
+}"#;
+
+/// What a file input holds now.
+const INPUT_FILES_FN: &str =
+  "function () { return Array.from(this.files || []).map((f) => ({ name: f.name, bytes: f.size })); }";
+
+/// What `file_upload` did.
+#[derive(Debug, Serialize)]
+struct UploadedFiles {
+  files: serde_json::Value,
+  #[serde(rename = "match", skip_serializing_if = "Option::is_none")]
+  matched: Option<LocatorCandidate>,
+}
+
+/// The files of a `file_upload` call, checked before anything touches the page.
+fn upload_files(
+  arguments: &serde_json::Value,
+) -> Result<Vec<crate::agent_uploads::UploadFile>, AgentError> {
+  use crate::agent_uploads::{clean_name, UploadFile, MAX_UPLOAD_BYTES, MAX_UPLOAD_FILES};
+  use base64::{engine::general_purpose, Engine as _};
+  let listed = arguments
+    .get("files")
+    .and_then(|v| v.as_array())
+    .filter(|files| !files.is_empty())
+    .ok_or_else(|| AgentError::InvalidArgument("files must list at least one file".into()))?;
+  if listed.len() > MAX_UPLOAD_FILES {
+    return Err(AgentError::InvalidArgument(format!(
+      "At most {MAX_UPLOAD_FILES} files per call"
+    )));
+  }
+  let mut files: Vec<UploadFile> = Vec::with_capacity(listed.len());
+  let mut total = 0usize;
+  for file in listed {
+    let raw_name = file
+      .get("name")
+      .and_then(|v| v.as_str())
+      .unwrap_or_default();
+    let name = clean_name(raw_name).ok_or_else(|| {
+      AgentError::InvalidArgument(format!(
+        "{raw_name:?} is not a usable file name; give a name like report.pdf"
+      ))
+    })?;
+    if files.iter().any(|f| f.name.eq_ignore_ascii_case(&name)) {
+      return Err(AgentError::InvalidArgument(format!(
+        "Two files are named {name}; give each its own name"
+      )));
+    }
+    let bytes = match (
+      file.get("text").and_then(|v| v.as_str()),
+      file.get("content_base64").and_then(|v| v.as_str()),
+    ) {
+      (Some(text), None) => text.as_bytes().to_vec(),
+      (None, Some(encoded)) => {
+        let encoded = encoded
+          .split_once(";base64,")
+          .map_or(encoded, |(_, data)| data);
+        let compact: String = encoded.chars().filter(|c| !c.is_whitespace()).collect();
+        [
+          general_purpose::STANDARD,
+          general_purpose::STANDARD_NO_PAD,
+          general_purpose::URL_SAFE,
+          general_purpose::URL_SAFE_NO_PAD,
+        ]
+        .iter()
+        .find_map(|engine| engine.decode(&compact).ok())
+        .ok_or_else(|| {
+          AgentError::InvalidArgument(format!("content_base64 of {name} is not base64"))
+        })?
+      }
+      _ => {
+        return Err(AgentError::InvalidArgument(format!(
+          "Give {name} exactly one of text or content_base64"
+        )))
+      }
+    };
+    total += bytes.len();
+    if total > MAX_UPLOAD_BYTES {
+      return Err(AgentError::InvalidArgument(format!(
+        "The files come to more than {} KB, the most one call carries",
+        MAX_UPLOAD_BYTES / 1024
+      )));
+    }
+    files.push(UploadFile { name, bytes });
+  }
+  Ok(files)
+}
+
+async fn agent_file_upload(
+  ctx: &AgentContext,
+  element: &ElementRef,
+  files: &[crate::agent_uploads::UploadFile],
+) -> Result<UploadedFiles, AgentError> {
+  let profile_id = ctx.profile.id.to_string();
+  let mut session = WayfernSession::open(&ctx.target).await?;
+  let outcome = async {
+    let (object, matched) = form_element(&mut session, ctx.engine, element).await?;
+    let reply = session
+      .call(
+        "Runtime.callFunctionOn",
+        serde_json::json!({
+          "objectId": object,
+          "functionDeclaration": FILE_INPUT_FN,
+          "returnByValue": false,
+          "objectGroup": FORM_GROUP,
+        }),
+      )
+      .await?;
+    if let Some(thrown) = script_exception(&reply) {
+      return Err(thrown);
+    }
+    let input = match reply.pointer("/result/objectId").and_then(|v| v.as_str()) {
+      Some(input) => input.to_string(),
+      None => {
+        let reason = reply
+          .pointer("/result/value")
+          .and_then(|v| v.as_str())
+          .unwrap_or_default();
+        return Err(AgentError::BadRequest(match reason {
+          "many" => "The element holds more than one file input; name the input itself, e.g. with selector input[type=file].".to_string(),
+          "disabled" => "The file input is disabled.".to_string(),
+          other => format!(
+            "The element is a <{}>, not a file input, and holds none. Name the input itself, e.g. with selector input[type=file]; it may be hidden.",
+            other.trim_start_matches("none:")
+          ),
+        }));
+      }
+    };
+    let multiple = call_on(&mut session, &input, "function () { return this.multiple; }", serde_json::json!([]))
+      .await?
+      .as_bool()
+      .unwrap_or(false);
+    if files.len() > 1 && !multiple {
+      return Err(AgentError::InvalidArgument(
+        "This file input takes one file; send one.".to_string(),
+      ));
+    }
+    let staged = crate::agent_uploads::stage(&profile_id, files)
+      .map_err(|e| AgentError::Browser(format!("Could not write the files: {e}")))?;
+    let staged: Vec<String> = staged
+      .iter()
+      .map(|file| file.to_string_lossy().to_string())
+      .collect();
+    session
+      .call(
+        "DOM.setFileInputFiles",
+        serde_json::json!({ "files": staged, "objectId": input }),
+      )
+      .await?;
+    let held = call_on(&mut session, &input, INPUT_FILES_FN, serde_json::json!([])).await?;
+    Ok(UploadedFiles {
+      files: held,
+      matched,
+    })
+  }
+  .await;
+  let _ = session
+    .call(
+      "Runtime.releaseObjectGroup",
+      serde_json::json!({ "objectGroup": FORM_GROUP }),
+    )
+    .await;
+  session.close().await;
+  outcome
+}
+
+/// The schema of a form tool: the four ways to name its element, and `extra`.
+fn form_tool_schema(what: &str, extra: serde_json::Value, required: &[&str]) -> serde_json::Value {
+  let mut properties = serde_json::json!({
+    "profile_id": {
+      "type": "string",
+      "description": "The UUID of the running profile"
+    },
+    "selector": {
+      "type": "string",
+      "description": format!("CSS selector of the {what}")
+    },
+    "locator": locator_schema(&format!("Instead of selector: how to name the {what}")),
+    "index": {
+      "type": "integer",
+      "description": "Instead of selector: zero-based index from the last get_interactive_elements response"
+    },
+    "element_id": {
+      "type": "string",
+      "description": "Instead of index: the stable id (e12) from the last get_interactive_elements response"
+    }
+  });
+  if let (Some(properties), Some(extra)) = (properties.as_object_mut(), extra.as_object()) {
+    properties.extend(extra.clone());
+  }
+  let mut required_list = vec!["profile_id"];
+  required_list.extend_from_slice(required);
+  serde_json::json!({
+    "type": "object",
+    "properties": properties,
+    "required": required_list
+  })
+}
+
 /// The JSON schema of a locator argument, shared by every tool that takes one.
 fn locator_schema(description: &str) -> serde_json::Value {
   serde_json::json!({
@@ -2429,11 +2885,16 @@ const BATCH_TOOLS: &[&str] = &[
   "type_text",
   "type_by_index",
   "type_locator",
+  "select_option",
   "get_page_info",
 ];
 const MAX_BATCH_ACTIONS: usize = 20;
 /// How much of each step's answer a batch reports.
 const BATCH_RESULT_CHARS: usize = 2_000;
+/// How much of a captured body `get_network_request` shows when not told, and
+/// at most. The most stays under what one tool answer carries.
+const DEFAULT_BODY_CHARS: u64 = 20_000;
+const MAX_BODY_CHARS: u64 = 90_000;
 
 /// A tab helper's coded refusal as a tool error.
 fn tab_error(message: String) -> McpError {
@@ -3047,6 +3508,14 @@ impl McpServer {
         | "type_locator"
         | "extract_structured"
         | "pick_element"
+        | "select_option"
+        | "file_upload"
+        // A capture reads every request the browser makes, so starting one
+        // and reading it are browser reads like get_page_content, and are
+        // refused while the person has paused agents or holds the profile.
+        | "start_network_capture"
+        | "list_network_requests"
+        | "get_network_request"
         // Starting a bot run leases a remote host for up to two hours and
         // spends the account's pooled remote-hour budget, which makes it the
         // most expensive tool here. Cancelling one reaches the same fleet, and
@@ -4244,7 +4713,7 @@ impl McpServer {
       },
       McpTool {
         name: "run_actions".to_string(),
-        description: "Run several browser actions in one call, in order, on one profile: navigate, go_back, scroll, press_key, wait_for, the click and type tools, get_page_info. Stops at the first failure and, unless stop_on_change is false, as soon as the page address changes, since later steps were planned for the old page. Returns each step's result.".to_string(),
+        description: "Run several browser actions in one call, in order, on one profile: navigate, go_back, scroll, press_key, wait_for, the click and type tools, select_option, get_page_info. Stops at the first failure and, unless stop_on_change is false, as soon as the page address changes, since later steps were planned for the old page. Returns each step's result.".to_string(),
         input_schema: serde_json::json!({
           "type": "object",
           "properties": {
@@ -5009,6 +5478,150 @@ impl McpServer {
           "required": ["profile_id", "locator", "text"]
         }),
       },
+      McpTool {
+        name: "select_option".to_string(),
+        description: "Choose options of a native <select>, named by selector, locator, or index from get_interactive_elements; a label or a container that holds one <select> also works. Each option is matched by its value, then by its visible label. The select is focused and the input and change events a pick fires are dispatched in the page. For a custom dropdown that is not a <select>, click it open and click the option instead. Waits for a page load when the choice causes one.".to_string(),
+        input_schema: form_tool_schema(
+          "select element",
+          serde_json::json!({
+            "option": {
+              "type": "string",
+              "description": "The value or visible label of the option to choose"
+            },
+            "options": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Instead of option: every option to choose, for a <select multiple>"
+            }
+          }),
+          &[],
+        ),
+      },
+      McpTool {
+        name: "file_upload".to_string(),
+        description: "Put files into a file input (<input type=file>), named by selector, locator, or index; a label or a container that holds one file input also works, and the input may be hidden. Send each file's content: text for a text file, content_base64 for any file, at most 10 files and 700 KB in all per call. Donut writes them to a private folder on this computer and sets them on the input the way the file chooser does, so the page sees a trusted change; they are deleted when the browser stops. Setting files replaces what the input held. Only for profiles running on this computer.".to_string(),
+        input_schema: form_tool_schema(
+          "file input",
+          serde_json::json!({
+            "files": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 10,
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "The file name the page sees, with its extension (report.pdf)"
+                  },
+                  "text": {
+                    "type": "string",
+                    "description": "The content of a text file"
+                  },
+                  "content_base64": {
+                    "type": "string",
+                    "description": "Instead of text: the content as base64 (a data: URL works too)"
+                  }
+                },
+                "required": ["name"]
+              }
+            }
+          }),
+          &["files"],
+        ),
+      },
+      McpTool {
+        name: "start_network_capture".to_string(),
+        description: "Start recording the requests that every tab of a running profile makes, for list_network_requests and get_network_request. Nothing the page can see changes. The record is in memory only: at most 2,000 requests and text response bodies up to 2 MB each and 32 MB in all, the oldest dropped first. Cookie, Set-Cookie, Authorization and Proxy-Authorization values read [redacted]. Requests made while the person has paused agents or taken over the profile are not recorded. The capture and its record end when the browser stops, or with stop_network_capture. Only for profiles running on this computer; a capture already running is kept.".to_string(),
+        input_schema: serde_json::json!({
+          "type": "object",
+          "properties": {
+            "profile_id": {
+              "type": "string",
+              "description": "The UUID of the running profile"
+            }
+          },
+          "required": ["profile_id"]
+        }),
+      },
+      McpTool {
+        name: "stop_network_capture".to_string(),
+        description: "Stop a profile's network capture and delete its record.".to_string(),
+        input_schema: serde_json::json!({
+          "type": "object",
+          "properties": {
+            "profile_id": {
+              "type": "string",
+              "description": "The UUID of the profile"
+            }
+          },
+          "required": ["profile_id"]
+        }),
+      },
+      McpTool {
+        name: "list_network_requests".to_string(),
+        description: "List the requests a profile's network capture recorded, oldest first: id, tab, method, URL, type (Document, XHR, Fetch, Script, Image...), state (pending, done, failed, redirected, incomplete), status, MIME type, bytes, duration and what became of the body (kept, or why not). Filter by URL text, method, type, status, failure or body text. Page with after and limit; last_id is the newest id recorded, so after set to it later shows only new requests.".to_string(),
+        input_schema: serde_json::json!({
+          "type": "object",
+          "properties": {
+            "profile_id": {
+              "type": "string",
+              "description": "The UUID of the profile"
+            },
+            "after": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Only requests with a larger id: next_after or last_id from an earlier call"
+            },
+            "limit": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 200,
+              "description": "Requests per page, 50 when left out"
+            },
+            "url_contains": { "type": "string", "description": "Text the URL contains (any case)" },
+            "method": { "type": "string", "description": "GET, POST, ..." },
+            "type": { "type": "string", "description": "Document, XHR, Fetch, Script, Image, ..." },
+            "status": { "type": "integer", "description": "Only this HTTP status" },
+            "failed": { "type": "boolean", "description": "true: only requests that failed; false: none of them" },
+            "body_contains": { "type": "string", "description": "Text a kept response body contains (any case)" }
+          },
+          "required": ["profile_id"]
+        }),
+      },
+      McpTool {
+        name: "get_network_request".to_string(),
+        description: "One request a network capture recorded, in full: request and response headers, the request body (up to 64 KB), status, timing, and the response body when it is text. Read a long body in parts with body_offset and max_body_chars.".to_string(),
+        input_schema: serde_json::json!({
+          "type": "object",
+          "properties": {
+            "profile_id": {
+              "type": "string",
+              "description": "The UUID of the profile"
+            },
+            "request_id": {
+              "type": "integer",
+              "description": "The id from list_network_requests"
+            },
+            "body": {
+              "type": "boolean",
+              "description": "Include the response body (default: true)"
+            },
+            "body_offset": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "The character to start the body at: next_offset from the previous call"
+            },
+            "max_body_chars": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 90000,
+              "description": "The most body characters to show, 20000 when left out"
+            }
+          },
+          "required": ["profile_id", "request_id"]
+        }),
+      },
       McpTool {
         name: "extract_structured".to_string(),
         description: "Read rows off the live page natively, with no script injected: a container locator matches every row, each field locator is evaluated inside a row, and an optional next-page locator is clicked to advance. A missing container is a result (stopReason \"no-container\"), not an error. Every bound is reported through stopReason and truncated. Requires Wayfern 152.".to_string(),
@@ -5810,6 +6423,48 @@ impl McpServer {
         .await?;
         self.handle_type_locator(arguments).await
       }
+      "select_option" => {
+        Self::require_capability(
+          "Browser automation",
+          CLOUD_AUTH.can_use_browser_automation().await,
+        )
+        .await?;
+        self.handle_select_option(caller, arguments).await
+      }
+      "file_upload" => {
+        Self::require_capability(
+          "Browser automation",
+          CLOUD_AUTH.can_use_browser_automation().await,
+        )
+        .await?;
+        self.handle_file_upload(caller, arguments).await
+      }
+      "start_network_capture" => {
+        Self::require_capability(
+          "Browser automation",
+          CLOUD_AUTH.can_use_browser_automation().await,
+        )
+        .await?;
+        self.handle_start_network_capture(arguments).await
+      }
+      // Stopping only deletes; it works without a plan, like stop_sync_session.
+      "stop_network_capture" => Self::handle_stop_network_capture(arguments),
+      "list_network_requests" => {
+        Self::require_capability(
+          "Browser automation",
+          CLOUD_AUTH.can_use_browser_automation().await,
+        )
+        .await?;
+        Self::handle_list_network_requests(arguments)
+      }
+      "get_network_request" => {
+        Self::require_capability(
+          "Browser automation",
+          CLOUD_AUTH.can_use_browser_automation().await,
+        )
+        .await?;
+        Self::handle_get_network_request(arguments)
+      }
       "extract_structured" => {
         Self::require_capability(
           "Browser automation",
@@ -10490,6 +11145,219 @@ impl McpServer {
     Self::json_content(&typed)
   }
 
+  /// The element a form tool names: one of selector, locator, index or
+  /// element_id.
+  async fn form_element_ref(
+    &self,
+    caller: McpCaller<'_>,
+    profile_id: &str,
+    arguments: &serde_json::Value,
+  ) -> Result<ElementRef, McpError> {
+    let given = |key: &str| arguments.get(key).is_some_and(|v| !v.is_null());
+    let named = ["selector", "locator", "index", "element_id"]
+      .into_iter()
+      .filter(|key| given(key))
+      .count();
+    if named != 1 {
+      return Err(McpError {
+        code: -32602,
+        message: "Name the element one way: selector, locator, index or element_id".to_string(),
+        data: None,
+      });
+    }
+    if given("locator") {
+      let locator: LocatorDescription = Self::agent_arguments(&arguments["locator"])?;
+      validate_locator(&locator).map_err(AgentError::into_mcp)?;
+      return Ok(ElementRef::Locator(canonical_locator(&locator)));
+    }
+    if given("selector") {
+      return Ok(ElementRef::Selector(
+        Self::require_str(arguments, "selector")?.to_string(),
+      ));
+    }
+    let cache = interactive_cache_slot(require_indexed_session(caller)?);
+    let index = self.element_index(profile_id, &cache, arguments).await?;
+    Ok(ElementRef::Index { cache, index })
+  }
+
+  async fn handle_select_option(
+    &self,
+    caller: McpCaller<'_>,
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let wanted: Option<Vec<String>> = match (arguments.get("option"), arguments.get("options")) {
+      (Some(serde_json::Value::String(one)), None) => Some(vec![one.clone()]),
+      (None, Some(serde_json::Value::Array(many))) if !many.is_empty() => many
+        .iter()
+        .map(|v| v.as_str().map(str::to_string))
+        .collect(),
+      _ => None,
+    };
+    let wanted = wanted.ok_or_else(|| McpError {
+      code: -32602,
+      message: "Give option (one value or label) or options (a list of them)".to_string(),
+      data: None,
+    })?;
+    let element = self.form_element_ref(caller, profile_id, arguments).await?;
+    let ctx = self.agent_context(profile_id).await?;
+    let selected = agent_select_option(&ctx, &element, &wanted)
+      .await
+      .map_err(AgentError::into_mcp)?;
+    Self::json_content(&selected)
+  }
+
+  async fn handle_file_upload(
+    &self,
+    caller: McpCaller<'_>,
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let files = upload_files(arguments).map_err(AgentError::into_mcp)?;
+    let element = self.form_element_ref(caller, profile_id, arguments).await?;
+    let ctx = self.agent_context(profile_id).await?;
+    if ctx.target.is_remote() {
+      return Err(McpError {
+        code: -32000,
+        message: "file_upload works only for a profile whose browser runs on this computer."
+          .to_string(),
+        data: Some(serde_json::json!({ "code": "FILE_UPLOAD_LOCAL_ONLY" })),
+      });
+    }
+    // A browser that exited by itself left its files; nothing reads them now.
+    if let Ok(profiles) = ProfileManager::instance().list_profiles() {
+      let running: HashSet<String> = profiles
+        .iter()
+        .filter(|p| p.process_id.is_some())
+        .map(|p| p.id.to_string())
+        .collect();
+      crate::agent_uploads::sweep(|id| running.contains(id));
+    }
+    let uploaded = agent_file_upload(&ctx, &element, &files)
+      .await
+      .map_err(AgentError::into_mcp)?;
+    Self::json_content(&uploaded)
+  }
+
+  async fn handle_start_network_capture(
+    &self,
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    use crate::network_capture::StartError;
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let profile = self.get_wayfern_profile(profile_id)?;
+    match crate::network_capture::start(&profile).await {
+      Ok(answer) => Self::json_content(&answer),
+      Err(StartError::NotLocal) => Err(McpError {
+        code: -32000,
+        message: "No browser of this profile runs on this computer. Network capture works for a profile launched here with run_profile, not on the remote fleet.".to_string(),
+        data: Some(serde_json::json!({ "code": "NETWORK_CAPTURE_LOCAL_ONLY" })),
+      }),
+      Err(StartError::Refused(reason)) => Err(McpError {
+        code: -32000,
+        message: format!("The browser did not accept the capture: {reason}"),
+        data: Some(serde_json::json!({ "code": "NETWORK_CAPTURE_FAILED" })),
+      }),
+    }
+  }
+
+  fn handle_stop_network_capture(
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let answer = match crate::network_capture::stop(profile_id) {
+      Some(requests) => serde_json::json!({ "stopped": true, "requests": requests }),
+      None => serde_json::json!({ "stopped": false }),
+    };
+    Self::json_content(&answer)
+  }
+
+  fn capture_not_running() -> McpError {
+    McpError {
+      code: -32000,
+      message: "No network capture runs for this profile. Call start_network_capture first; a capture ends when its browser stops.".to_string(),
+      data: Some(serde_json::json!({ "code": "NETWORK_CAPTURE_NOT_RUNNING" })),
+    }
+  }
+
+  fn handle_list_network_requests(
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    use crate::mcp_views::{DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT};
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let text = |key: &str| {
+      arguments
+        .get(key)
+        .and_then(|v| v.as_str())
+        .filter(|v| !v.is_empty())
+        .map(str::to_string)
+    };
+    let limit = match arguments.get("limit") {
+      None | Some(serde_json::Value::Null) => DEFAULT_LIST_LIMIT,
+      Some(value) => value
+        .as_u64()
+        .filter(|n| (1..=MAX_LIST_LIMIT as u64).contains(n))
+        .ok_or_else(|| McpError {
+          code: -32602,
+          message: format!("limit is a whole number from 1 to {MAX_LIST_LIMIT}"),
+          data: None,
+        })? as usize,
+    };
+    let query = crate::network_capture::ListQuery {
+      after: arguments.get("after").and_then(|v| v.as_u64()).unwrap_or(0),
+      limit,
+      url_contains: text("url_contains"),
+      method: text("method"),
+      resource_type: text("type"),
+      status: arguments.get("status").and_then(|v| v.as_u64()),
+      failed: arguments.get("failed").and_then(|v| v.as_bool()),
+      body_contains: text("body_contains"),
+    };
+    let answer = crate::network_capture::read(profile_id, |log| log.list(&query))
+      .ok_or_else(Self::capture_not_running)?;
+    Self::json_content(&answer)
+  }
+
+  fn handle_get_network_request(
+    arguments: &serde_json::Value,
+  ) -> Result<serde_json::Value, McpError> {
+    let profile_id = Self::require_str(arguments, "profile_id")?;
+    let id = arguments
+      .get("request_id")
+      .and_then(|v| v.as_u64())
+      .ok_or_else(|| McpError {
+        code: -32602,
+        message: "Missing request_id".to_string(),
+        data: None,
+      })?;
+    let with_body = arguments
+      .get("body")
+      .and_then(|v| v.as_bool())
+      .unwrap_or(true);
+    let offset = arguments
+      .get("body_offset")
+      .and_then(|v| v.as_u64())
+      .unwrap_or(0) as usize;
+    let max_chars = arguments
+      .get("max_body_chars")
+      .and_then(|v| v.as_u64())
+      .unwrap_or(DEFAULT_BODY_CHARS)
+      .clamp(1, MAX_BODY_CHARS) as usize;
+    match crate::network_capture::read(profile_id, |log| {
+      log.detail(id, with_body, offset, max_chars)
+    }) {
+      None => Err(Self::capture_not_running()),
+      Some(None) => Err(McpError {
+        code: -32000,
+        message: format!(
+          "No request {id} in the capture. Ids come from list_network_requests; the oldest are dropped past 2,000."
+        ),
+        data: Some(serde_json::json!({ "code": "NETWORK_REQUEST_NOT_FOUND" })),
+      }),
+      Some(Some(answer)) => Self::json_content(&answer),
+    }
+  }
+
   async fn handle_extract_structured(
     &self,
     arguments: &serde_json::Value,
@@ -11645,7 +12513,7 @@ mod tests {
     // tool was added or removed on purpose.
     assert_eq!(
       tools.len(),
-      107,
+      113,
       "the tool list is a published contract; update this number deliberately"
     );
 
@@ -11736,6 +12604,13 @@ mod tests {
     assert!(tool_names.contains(&"resolve_locator"));
     assert!(tool_names.contains(&"click_locator"));
     assert!(tool_names.contains(&"type_locator"));
+    assert!(tool_names.contains(&"select_option"));
+    assert!(tool_names.contains(&"file_upload"));
+    // Network capture tools
+    assert!(tool_names.contains(&"start_network_capture"));
+    assert!(tool_names.contains(&"stop_network_capture"));
+    assert!(tool_names.contains(&"list_network_requests"));
+    assert!(tool_names.contains(&"get_network_request"));
     assert!(tool_names.contains(&"extract_structured"));
     assert!(tool_names.contains(&"pick_element"));
     // Remote fleet: an agent must be able to start a session, see it become
@@ -12471,8 +13346,8 @@ mod tests {
       production.matches("window[__CACHE__]").count()
         + production.matches("window[{cache}]").count()
         + production.matches("window[{slot}]").count(),
-      8,
-      "the eight cache sites (one write, five reads, two in the teardown) must \
+      9,
+      "the nine cache sites (one write, six reads, two in the teardown) must \
        all be parameterised"
     );
   }
@@ -13442,6 +14317,12 @@ mod tests {
       "type_locator",
       "extract_structured",
       "pick_element",
+      "select_option",
+      "file_upload",
+      // A capture reads every request the browser makes.
+      "start_network_capture",
+      "list_network_requests",
+      "get_network_request",
       // Leases a remote host for up to two hours and spends the pooled
       // remote-hour budget.
       "run_cookie_bot_now",
@@ -14103,6 +14984,11 @@ mod tests {
       "type_locator",
       "extract_structured",
       "pick_element",
+      "select_option",
+      "file_upload",
+      "start_network_capture",
+      "list_network_requests",
+      "get_network_request",
     ] {
       assert!(
         advertised.iter().any(|t| t == tool),
@@ -14402,4 +15288,155 @@ mod tests {
     let feedback = item.feedback.as_ref().unwrap();
     assert_eq!((feedback.kind.as_str(), feedback.logs), ("bug", true));
   }
+
+  #[test]
+  fn upload_files_are_read_and_checked_before_the_page_is_touched() {
+    let files = upload_files(&serde_json::json!({
+      "files": [
+        { "name": "notes.txt", "text": "héllo" },
+        { "name": "../pic.png", "content_base64": "data:image/png;base64,AAEC\nAw==" },
+        { "name": "raw.bin", "content_base64": "_-8" },
+      ]
+    }))
+    .unwrap();
+    assert_eq!(files[0].name, "notes.txt");
+    assert_eq!(files[0].bytes, "héllo".as_bytes());
+    assert_eq!(files[1].name, "pic.png");
+    assert_eq!(files[1].bytes, vec![0, 1, 2, 3]);
+    assert_eq!(files[2].bytes, vec![0xff, 0xef]);
+
+    let refused =
+      |arguments: serde_json::Value| upload_files(&arguments).unwrap_err().into_mcp().message;
+    assert!(refused(serde_json::json!({})).contains("at least one file"));
+    assert!(refused(serde_json::json!({ "files": [] })).contains("at least one file"));
+    assert!(
+      refused(serde_json::json!({ "files": [{ "name": "a.txt" }] })).contains("exactly one of")
+    );
+    assert!(refused(
+      serde_json::json!({ "files": [{ "name": "a.txt", "text": "x", "content_base64": "eA==" }] })
+    )
+    .contains("exactly one of"));
+    assert!(
+      refused(serde_json::json!({ "files": [{ "name": "..", "text": "x" }] }))
+        .contains("not a usable file name")
+    );
+    assert!(refused(serde_json::json!({
+      "files": [{ "name": "a.txt", "text": "x" }, { "name": "A.TXT", "text": "y" }]
+    }))
+    .contains("Two files are named"));
+    assert!(refused(
+      serde_json::json!({ "files": [{ "name": "a.bin", "content_base64": "%%%" }] })
+    )
+    .contains("not base64"));
+    let many: Vec<serde_json::Value> = (0..=crate::agent_uploads::MAX_UPLOAD_FILES)
+      .map(|n| serde_json::json!({ "name": format!("{n}.txt"), "text": "x" }))
+      .collect();
+    assert!(refused(serde_json::json!({ "files": many })).contains("At most"));
+    let large = "x".repeat(crate::agent_uploads::MAX_UPLOAD_BYTES + 1);
+    assert!(
+      refused(serde_json::json!({ "files": [{ "name": "big.txt", "text": large }] }))
+        .contains("KB")
+    );
+  }
+
+  #[test]
+  fn a_select_refusal_tells_the_agent_what_to_do() {
+    let message = |answer: serde_json::Value| select_refusal(&answer).unwrap().into_mcp().message;
+    assert!(
+      message(serde_json::json!({ "error": "not_select", "tag": "div" }))
+        .contains("<div>, not a <select>")
+    );
+    let missing = message(serde_json::json!({
+      "error": "no_option",
+      "missing": ["Mars"],
+      "count": 2,
+      "options": [{ "value": "de", "label": "Germany", "disabled": false }],
+    }));
+    assert!(
+      missing.contains("Mars") && missing.contains("Germany"),
+      "{missing}"
+    );
+    assert!(message(serde_json::json!({ "error": "single" })).contains("takes one option"));
+    assert!(select_refusal(&serde_json::json!({ "selected": [], "changed": false })).is_none());
+  }
+
+  #[test]
+  fn a_form_tool_names_its_element_four_ways_and_reads_no_path() {
+    let server = McpServer::new();
+    for name in ["select_option", "file_upload"] {
+      let tool = server
+        .get_tools()
+        .into_iter()
+        .find(|tool| tool.name == name)
+        .unwrap();
+      let properties = tool.input_schema["properties"].as_object().unwrap();
+      for key in ["profile_id", "selector", "locator", "index", "element_id"] {
+        assert!(properties.contains_key(key), "{name} lacks {key}");
+      }
+      assert_eq!(tool.input_schema["required"][0], "profile_id");
+      assert!(!LOCAL_PATH_TOOLS.contains(&name));
+    }
+  }
+
+  #[tokio::test]
+  async fn a_form_tool_refuses_two_ways_of_naming_its_element() {
+    let server = McpServer::new();
+    let caller = McpCaller {
+      session: Some("s"),
+      toolsets: None,
+    };
+    for arguments in [
+      serde_json::json!({}),
+      serde_json::json!({ "selector": "#a", "index": 1 }),
+      serde_json::json!({ "locator": { "role": "button" }, "selector": "#a" }),
+    ] {
+      let error = server
+        .form_element_ref(caller, "p", &arguments)
+        .await
+        .err()
+        .unwrap();
+      assert!(error.message.contains("one way"), "{arguments}");
+    }
+    let named = server
+      .form_element_ref(
+        caller,
+        "p",
+        &serde_json::json!({ "selector": "select#country" }),
+      )
+      .await
+      .unwrap();
+    assert!(matches!(named, ElementRef::Selector(selector) if selector == "select#country"));
+    let located = server
+      .form_element_ref(
+        caller,
+        "p",
+        &serde_json::json!({ "locator": { "role": "textbox", "name": "Email" } }),
+      )
+      .await
+      .unwrap();
+    assert!(
+      matches!(located, ElementRef::Locator(locator) if locator.role.as_deref() == Some("textField"))
+    );
+  }
+
+  #[test]
+  fn network_reads_without_a_capture_say_how_to_start_one() {
+    let profile = serde_json::json!({ "profile_id": "no-capture-profile" });
+    let error = McpServer::handle_list_network_requests(&profile).unwrap_err();
+    assert_eq!(error.data.unwrap()["code"], "NETWORK_CAPTURE_NOT_RUNNING");
+    let error = McpServer::handle_get_network_request(&serde_json::json!({
+      "profile_id": "no-capture-profile",
+      "request_id": 1,
+    }))
+    .unwrap_err();
+    assert!(error.message.contains("start_network_capture"));
+    let error = McpServer::handle_list_network_requests(&serde_json::json!({
+      "profile_id": "no-capture-profile",
+      "limit": 0,
+    }))
+    .unwrap_err();
+    assert_eq!(error.code, -32602);
+    let stopped = McpServer::handle_stop_network_capture(&profile).unwrap();
+    assert_eq!(stopped["structuredContent"]["stopped"], false);
+  }
 }
diff --git a/src-tauri/src/mcp_toolsets.rs b/src-tauri/src/mcp_toolsets.rs
index 4bf29358..f8d15857 100644
--- a/src-tauri/src/mcp_toolsets.rs
+++ b/src-tauri/src/mcp_toolsets.rs
@@ -59,6 +59,8 @@ pub const TOOLSETS: &[(&str, &[&str])] = &[
       "resolve_locator",
       "click_locator",
       "type_locator",
+      "select_option",
+      "file_upload",
       "extract_structured",
       "pick_element",
       // The person watching
@@ -104,6 +106,15 @@ pub const TOOLSETS: &[(&str, &[&str])] = &[
       "get_dns_blocklist_status",
     ],
   ),
+  (
+    "traffic",
+    &[
+      "start_network_capture",
+      "stop_network_capture",
+      "list_network_requests",
+      "get_network_request",
+    ],
+  ),
   (
     "fingerprint",
     &["get_profile_fingerprint", "update_profile_fingerprint"],
diff --git a/src-tauri/src/network_capture.rs b/src-tauri/src/network_capture.rs
new file mode 100644
index 00000000..e9a84445
--- /dev/null
+++ b/src-tauri/src/network_capture.rs
@@ -0,0 +1,1245 @@
+//! Network capture for agents: what the pages of a profile running on this
+//! computer request and receive, kept in memory while an agent asks for it.
+//!
+//! One browser-level socket attaches to every tab, and to every frame that runs
+//! in a process of its own, and turns the Network domain on there. Nothing the
+//! page can see changes. Nothing is written to disk or to the log, the values
+//! of cookie and authorization headers are replaced, only text bodies are kept,
+//! and nothing is recorded while the person has paused agents or taken over the
+//! profile. The capture ends with the browser, and its data with it.
+
+use crate::cdp_target::CdpConnection;
+use crate::profile::BrowserProfile;
+use serde_json::{json, Map, Value};
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{LazyLock, Mutex};
+use std::time::Duration;
+
+/// Requests kept per profile; the oldest go first.
+const MAX_ENTRIES: usize = 2_000;
+/// The largest response body kept.
+const MAX_BODY_BYTES: usize = 2 * 1024 * 1024;
+/// All bodies kept for one profile; the oldest go first.
+const MAX_STORED_BODY_BYTES: usize = 32 * 1024 * 1024;
+/// The longest request body kept.
+const MAX_POST_DATA_BYTES: usize = 64 * 1024;
+/// How much of a URL a list shows.
+const LIST_URL_CHARS: usize = 300;
+/// Headers whose values are credentials.
+const SECRET_HEADERS: [&str; 4] = [
+  "authorization",
+  "cookie",
+  "proxy-authorization",
+  "set-cookie",
+];
+const REDACTED: &str = "[redacted]";
+/// How long `start` waits for the browser to accept the attach.
+const ATTACH_TIMEOUT: Duration = Duration::from_secs(10);
+/// The id of the browser-level attach command; the pump numbers the rest
+/// after it.
+const ATTACH_ID: u64 = 1;
+/// Body fetches the pump waits for at once. A tab that closes never answers
+/// its own, so the map is emptied when it passes this.
+const MAX_PENDING_FETCHES: usize = 4_096;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum State {
+  Pending,
+  Done,
+  Failed,
+  Redirected,
+  Incomplete,
+}
+
+impl State {
+  fn name(self) -> &'static str {
+    match self {
+      Self::Pending => "pending",
+      Self::Done => "done",
+      Self::Failed => "failed",
+      Self::Redirected => "redirected",
+      Self::Incomplete => "incomplete",
+    }
+  }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+enum Body {
+  /// The response has not finished loading.
+  Waiting,
+  /// Asked of the browser, not answered yet.
+  Fetching,
+  Kept(String),
+  /// Why there is no body.
+  Skipped(&'static str),
+}
+
+impl Body {
+  fn summary(&self) -> &str {
+    match self {
+      Self::Waiting | Self::Fetching => "pending",
+      Self::Kept(_) => "kept",
+      Self::Skipped(reason) => reason,
+    }
+  }
+}
+
+#[derive(Debug, Clone)]
+struct Entry {
+  id: u64,
+  session: String,
+  request_id: String,
+  tab: String,
+  method: String,
+  url: String,
+  resource_type: String,
+  request_headers: Map<String, Value>,
+  post_data: Option<String>,
+  post_data_truncated: bool,
+  /// Unix milliseconds.
+  started_at: f64,
+  /// The browser's monotonic clock, in seconds.
+  started: f64,
+  status: Option<u64>,
+  status_text: Option<String>,
+  response_headers: Map<String, Value>,
+  mime_type: Option<String>,
+  protocol: Option<String>,
+  from_cache: bool,
+  state: State,
+  error: Option<String>,
+  encoded_bytes: Option<u64>,
+  duration_ms: Option<f64>,
+  body: Body,
+}
+
+/// A command the capture sends to the browser.
+#[derive(Debug, PartialEq)]
+pub(crate) struct Command {
+  pub session: Option<String>,
+  pub method: &'static str,
+  pub params: Value,
+  /// The entry whose body this command fetches.
+  pub body_for: Option<u64>,
+}
+
+impl Command {
+  fn setup(session: &str, method: &'static str, params: Value) -> Self {
+    Self {
+      session: Some(session.to_string()),
+      method,
+      params,
+      body_for: None,
+    }
+  }
+}
+
+/// What a capture has seen, and what it still waits for.
+#[derive(Default)]
+pub(crate) struct CaptureLog {
+  entries: VecDeque<Entry>,
+  /// `(session, request id)` of a request still loading, to its entry.
+  open: HashMap<(String, String), u64>,
+  /// Each attached session, to the tab it belongs to.
+  sessions: HashMap<String, String>,
+  next_id: u64,
+  body_bytes: usize,
+  evicted: u64,
+  /// Requests not recorded while the person was in control.
+  withheld: u64,
+}
+
+fn str_of<'a>(value: &'a Value, key: &str) -> Option<&'a str> {
+  value.get(key).and_then(Value::as_str)
+}
+
+/// The headers with every credential value replaced.
+fn redacted(headers: Option<&Value>) -> Map<String, Value> {
+  let Some(Value::Object(headers)) = headers else {
+    return Map::new();
+  };
+  headers
+    .iter()
+    .map(|(name, value)| {
+      if SECRET_HEADERS.contains(&name.to_ascii_lowercase().as_str()) {
+        (name.clone(), Value::from(REDACTED))
+      } else {
+        (name.clone(), value.clone())
+      }
+    })
+    .collect()
+}
+
+/// Whether a response of this kind is text an agent reads.
+fn keeps_body(resource_type: &str, mime_type: Option<&str>) -> bool {
+  if matches!(
+    resource_type,
+    "Image"
+      | "Media"
+      | "Font"
+      | "Script"
+      | "Stylesheet"
+      | "TextTrack"
+      | "Manifest"
+      | "WebSocket"
+      | "EventSource"
+      | "Ping"
+      | "CSPViolationReport"
+      | "Preflight"
+  ) {
+    return false;
+  }
+  let Some(mime) = mime_type else {
+    return false;
+  };
+  let mime = mime.to_ascii_lowercase();
+  mime.starts_with("text/")
+    || mime.contains("json")
+    || mime.contains("xml")
+    || mime.contains("javascript")
+    || mime.contains("graphql")
+    || mime == "application/x-www-form-urlencoded"
+}
+
+/// `text` cut to `max` bytes at a character boundary.
+fn cut(text: &str, max: usize) -> (&str, bool) {
+  if text.len() <= max {
+    return (text, false);
+  }
+  let mut end = max;
+  while !text.is_char_boundary(end) {
+    end -= 1;
+  }
+  (&text[..end], true)
+}
+
+impl CaptureLog {
+  /// Read one event from the browser, and answer with what to send it.
+  ///
+  /// `private` is whether the person is in control right now: a request that
+  /// starts then is not recorded.
+  pub(crate) fn on_event(
+    &mut self,
+    session: Option<&str>,
+    method: &str,
+    params: &Value,
+    private: bool,
+  ) -> Vec<Command> {
+    match method {
+      "Target.attachedToTarget" => self.attached(session, params),
+      "Target.detachedFromTarget" => {
+        if let Some(gone) = str_of(params, "sessionId") {
+          self.detached(gone);
+        }
+        Vec::new()
+      }
+      _ => {
+        let Some(session) = session else {
+          return Vec::new();
+        };
+        let Some(request_id) = str_of(params, "requestId") else {
+          return Vec::new();
+        };
+        let key = (session.to_string(), request_id.to_string());
+        match method {
+          "Network.requestWillBeSent" => {
+            self.request(key, params, private);
+            Vec::new()
+          }
+          "Network.requestServedFromCache" => {
+            if let Some(entry) = self.open_entry(&key) {
+              entry.from_cache = true;
+            }
+            Vec::new()
+          }
+          "Network.responseReceived" => {
+            if let Some(entry) = self.open_entry(&key) {
+              let response = params.get("response").unwrap_or(&Value::Null);
+              entry.status = response.get("status").and_then(Value::as_u64);
+              entry.status_text = str_of(response, "statusText").map(str::to_string);
+              entry.response_headers = redacted(response.get("headers"));
+              entry.mime_type = str_of(response, "mimeType").map(str::to_string);
+              entry.protocol = str_of(response, "protocol").map(str::to_string);
+              entry.from_cache |= ["fromDiskCache", "fromServiceWorker", "fromPrefetchCache"]
+                .iter()
+                .any(|flag| response.get(*flag).and_then(Value::as_bool) == Some(true));
+              if let Some(kind) = str_of(params, "type") {
+                entry.resource_type = kind.to_string();
+              }
+            }
+            Vec::new()
+          }
+          "Network.loadingFinished" => self.finished(&key, params),
+          "Network.loadingFailed" => {
+            if let Some(id) = self.open.remove(&key) {
+              if let Some(entry) = self.entry_mut(id) {
+                entry.state = State::Failed;
+                entry.error = Some(
+                  if params.get("canceled").and_then(Value::as_bool) == Some(true) {
+                    "canceled".to_string()
+                  } else {
+                    let text = str_of(params, "errorText").unwrap_or("failed");
+                    match str_of(params, "blockedReason") {
+                      Some(reason) => format!("{text} (blocked: {reason})"),
+                      None => text.to_string(),
+                    }
+                  },
+                );
+                entry.duration_ms = duration(entry.started, params);
+                entry.body = Body::Skipped("failed");
+              }
+            }
+            Vec::new()
+          }
+          _ => Vec::new(),
+        }
+      }
+    }
+  }
+
+  fn attached(&mut self, parent: Option<&str>, params: &Value) -> Vec<Command> {
+    let Some(child) = str_of(params, "sessionId") else {
+      return Vec::new();
+    };
+    let info = params.get("targetInfo").unwrap_or(&Value::Null);
+    let kind = str_of(info, "type").unwrap_or_default();
+    if kind != "page" && kind != "iframe" {
+      return Vec::new();
+    }
+    let target = str_of(info, "targetId").unwrap_or_default().to_string();
+    // A frame belongs to the tab whose session reported it.
+    let tab = match kind {
+      "page" => target,
+      _ => parent
+        .and_then(|parent| self.sessions.get(parent).cloned())
+        .unwrap_or(target),
+    };
+    self.sessions.insert(child.to_string(), tab);
+    let mut commands = vec![
+      Command::setup(
+        child,
+        "Network.enable",
+        json!({ "maxPostDataSize": MAX_POST_DATA_BYTES }),
+      ),
+      Command::setup(
+        child,
+        "Target.setAutoAttach",
+        json!({
+          "autoAttach": true,
+          "waitForDebuggerOnStart": false,
+          "flatten": true,
+          "filter": [{ "type": "iframe" }],
+        }),
+      ),
+    ];
+    if params.get("waitingForDebugger").and_then(Value::as_bool) == Some(true) {
+      commands.push(Command::setup(
+        child,
+        "Runtime.runIfWaitingForDebugger",
+        json!({}),
+      ));
+    }
+    commands
+  }
+
+  fn detached(&mut self, session: &str) {
+    self.sessions.remove(session);
+    let gone: Vec<u64> = self
+      .open
+      .iter()
+      .filter(|((owner, _), _)| owner == session)
+      .map(|(_, id)| *id)
+      .collect();
+    self.open.retain(|(owner, _), _| owner != session);
+    for id in gone {
+      if let Some(entry) = self.entry_mut(id) {
+        entry.state = State::Incomplete;
+        entry.body = Body::Skipped("tab closed");
+      }
+    }
+  }
+
+  fn request(&mut self, key: (String, String), params: &Value, private: bool) {
+    // A redirect reuses the request id: the hop that was answered ends here.
+    if let Some(redirect) = params.get("redirectResponse") {
+      if let Some(id) = self.open.remove(&key) {
+        if let Some(entry) = self.entry_mut(id) {
+          entry.state = State::Redirected;
+          entry.status = redirect.get("status").and_then(Value::as_u64);
+          entry.status_text = str_of(redirect, "statusText").map(str::to_string);
+          entry.response_headers = redacted(redirect.get("headers"));
+          entry.duration_ms = duration(entry.started, params);
+          entry.body = Body::Skipped("redirect");
+        }
+      }
+    }
+    let request = params.get("request").unwrap_or(&Value::Null);
+    let url = str_of(request, "url").unwrap_or_default();
+    let lowered = url.to_ascii_lowercase();
+    if !lowered.starts_with("http://") && !lowered.starts_with("https://") {
+      return;
+    }
+    if private {
+      self.withheld += 1;
+      return;
+    }
+    let (post_data, post_data_truncated) = match str_of(request, "postData") {
+      Some(data) => {
+        let (kept, truncated) = cut(data, MAX_POST_DATA_BYTES);
+        (Some(kept.to_string()), truncated)
+      }
+      // The browser leaves out a body larger than `maxPostDataSize`.
+      None => (
+        None,
+        request.get("hasPostData").and_then(Value::as_bool) == Some(true),
+      ),
+    };
+    self.next_id += 1;
+    let id = self.next_id;
+    self.entries.push_back(Entry {
+      id,
+      tab: self.sessions.get(&key.0).cloned().unwrap_or_default(),
+      session: key.0.clone(),
+      request_id: key.1.clone(),
+      method: str_of(request, "method").unwrap_or("GET").to_string(),
+      url: url.to_string(),
+      resource_type: str_of(params, "type").unwrap_or("Other").to_string(),
+      request_headers: redacted(request.get("headers")),
+      post_data,
+      post_data_truncated,
+      started_at: params
+        .get("wallTime")
+        .and_then(Value::as_f64)
+        .map_or(0.0, |seconds| (seconds * 1000.0).round()),
+      started: params
+        .get("timestamp")
+        .and_then(Value::as_f64)
+        .unwrap_or_default(),
+      status: None,
+      status_text: None,
+      response_headers: Map::new(),
+      mime_type: None,
+      protocol: None,
+      from_cache: false,
+      state: State::Pending,
+      error: None,
+      encoded_bytes: None,
+      duration_ms: None,
+      body: Body::Waiting,
+    });
+    self.open.insert(key, id);
+    while self.entries.len() > MAX_ENTRIES {
+      if let Some(old) = self.entries.pop_front() {
+        if let Body::Kept(text) = &old.body {
+          self.body_bytes -= text.len();
+        }
+        self.open.remove(&(old.session, old.request_id));
+        self.evicted += 1;
+      }
+    }
+  }
+
+  fn finished(&mut self, key: &(String, String), params: &Value) -> Vec<Command> {
+    let Some(id) = self.open.remove(key) else {
+      return Vec::new();
+    };
+    let Some(entry) = self.entry_mut(id) else {
+      return Vec::new();
+    };
+    entry.state = State::Done;
+    entry.duration_ms = duration(entry.started, params);
+    entry.encoded_bytes = params
+      .get("encodedDataLength")
+      .and_then(Value::as_f64)
+      .map(|bytes| bytes.max(0.0) as u64);
+    if !keeps_body(&entry.resource_type, entry.mime_type.as_deref()) {
+      entry.body = Body::Skipped("not text");
+      return Vec::new();
+    }
+    if entry
+      .encoded_bytes
+      .is_some_and(|bytes| bytes as usize > MAX_BODY_BYTES)
+    {
+      entry.body = Body::Skipped("too large");
+      return Vec::new();
+    }
+    entry.body = Body::Fetching;
+    vec![Command {
+      session: Some(key.0.clone()),
+      method: "Network.getResponseBody",
+      params: json!({ "requestId": key.1 }),
+      body_for: Some(id),
+    }]
+  }
+
+  /// Store the browser's answer to a body fetch; `None` when it refused.
+  pub(crate) fn on_body(&mut self, id: u64, result: Option<&Value>) {
+    let Some(entry) = self.entry_mut(id) else {
+      return;
+    };
+    if entry.body != Body::Fetching {
+      return;
+    }
+    let Some(result) = result else {
+      entry.body = Body::Skipped("unavailable");
+      return;
+    };
+    if result.get("base64Encoded").and_then(Value::as_bool) == Some(true) {
+      entry.body = Body::Skipped("binary");
+      return;
+    }
+    let text = str_of(result, "body").unwrap_or_default();
+    if text.len() > MAX_BODY_BYTES {
+      entry.body = Body::Skipped("too large");
+      return;
+    }
+    entry.body = Body::Kept(text.to_string());
+    self.body_bytes += text.len();
+    for old in self.entries.iter_mut() {
+      if self.body_bytes <= MAX_STORED_BODY_BYTES {
+        break;
+      }
+      if let Body::Kept(text) = &old.body {
+        self.body_bytes -= text.len();
+        old.body = Body::Skipped("dropped to stay under the memory limit");
+      }
+    }
+  }
+
+  fn entry_mut(&mut self, id: u64) -> Option<&mut Entry> {
+    let index = self.entries.partition_point(|entry| entry.id < id);
+    self.entries.get_mut(index).filter(|entry| entry.id == id)
+  }
+
+  fn entry(&self, id: u64) -> Option<&Entry> {
+    let index = self.entries.partition_point(|entry| entry.id < id);
+    self.entries.get(index).filter(|entry| entry.id == id)
+  }
+
+  fn open_entry(&mut self, key: &(String, String)) -> Option<&mut Entry> {
+    let id = *self.open.get(key)?;
+    self.entry_mut(id)
+  }
+
+  fn tabs(&self) -> usize {
+    self.sessions.values().collect::<HashSet<_>>().len()
+  }
+
+  /// The requests that match `query`, oldest first, in short form.
+  pub(crate) fn list(&self, query: &ListQuery) -> Value {
+    let mut matching = self
+      .entries
+      .iter()
+      .filter(|entry| entry.id > query.after && query.matches(entry));
+    let requests: Vec<Value> = matching.by_ref().take(query.limit).map(summary).collect();
+    let next_after = if matching.next().is_some() {
+      requests
+        .last()
+        .and_then(|last| last.get("id"))
+        .and_then(Value::as_u64)
+    } else {
+      None
+    };
+    json!({
+      "requests": requests,
+      "next_after": next_after,
+      "last_id": self.next_id,
+      "kept": self.entries.len(),
+      "evicted": self.evicted,
+      "withheld": self.withheld,
+    })
+  }
+
+  /// One request in full. Its body is shown from `offset` for at most
+  /// `max_chars` characters.
+  pub(crate) fn detail(
+    &self,
+    id: u64,
+    with_body: bool,
+    offset: usize,
+    max_chars: usize,
+  ) -> Option<Value> {
+    let entry = self.entry(id)?;
+    let mut value = summary(entry);
+    value["url"] = Value::from(entry.url.clone());
+    value["status_text"] = json!(entry.status_text);
+    value["protocol"] = json!(entry.protocol);
+    value["from_cache"] = Value::from(entry.from_cache);
+    value["started_at"] = Value::from(entry.started_at);
+    value["error"] = json!(entry.error);
+    value["request_headers"] = Value::Object(entry.request_headers.clone());
+    value["post_data"] = json!(entry.post_data);
+    value["post_data_truncated"] = Value::from(entry.post_data_truncated);
+    value["response_headers"] = Value::Object(entry.response_headers.clone());
+    if let (true, Body::Kept(text)) = (with_body, &entry.body) {
+      let total = text.chars().count();
+      let shown: String = text.chars().skip(offset).take(max_chars).collect();
+      let end = offset.saturating_add(shown.chars().count());
+      value["body"] = json!({
+        "text": shown,
+        "offset": offset,
+        "chars": total,
+        "next_offset": (end < total).then_some(end),
+      });
+    }
+    Some(value)
+  }
+}
+
+fn duration(started: f64, params: &Value) -> Option<f64> {
+  let at = params.get("timestamp").and_then(Value::as_f64)?;
+  Some(((at - started) * 1000.0).max(0.0).round())
+}
+
+fn summary(entry: &Entry) -> Value {
+  let (url, cut_off) = cut(&entry.url, LIST_URL_CHARS);
+  json!({
+    "id": entry.id,
+    "tab": entry.tab,
+    "method": entry.method,
+    "url": if cut_off { format!("{url}…") } else { url.to_string() },
+    "type": entry.resource_type,
+    "state": entry.state.name(),
+    "status": entry.status,
+    "mime": entry.mime_type,
+    "bytes": entry.encoded_bytes,
+    "ms": entry.duration_ms,
+    "body": entry.body.summary(),
+  })
+}
+
+/// What `list_network_requests` filters by.
+#[derive(Debug, Default)]
+pub(crate) struct ListQuery {
+  pub after: u64,
+  pub limit: usize,
+  pub url_contains: Option<String>,
+  pub method: Option<String>,
+  pub resource_type: Option<String>,
+  pub status: Option<u64>,
+  pub failed: Option<bool>,
+  pub body_contains: Option<String>,
+}
+
+impl ListQuery {
+  fn matches(&self, entry: &Entry) -> bool {
+    let contains = |haystack: &str, needle: &str| {
+      haystack
+        .to_lowercase()
+        .contains(needle.to_lowercase().as_str())
+    };
+    self
+      .url_contains
+      .as_deref()
+      .is_none_or(|needle| contains(&entry.url, needle))
+      && self
+        .method
+        .as_deref()
+        .is_none_or(|method| entry.method.eq_ignore_ascii_case(method))
+      && self
+        .resource_type
+        .as_deref()
+        .is_none_or(|kind| entry.resource_type.eq_ignore_ascii_case(kind))
+      && self
+        .status
+        .is_none_or(|status| entry.status == Some(status))
+      && self
+        .failed
+        .is_none_or(|failed| (entry.state == State::Failed) == failed)
+      && self
+        .body_contains
+        .as_deref()
+        .is_none_or(|needle| match &entry.body {
+          Body::Kept(text) => contains(text, needle),
+          _ => false,
+        })
+  }
+}
+
+struct Capture {
+  generation: u64,
+  log: CaptureLog,
+  task: tokio::task::AbortHandle,
+}
+
+static CAPTURES: LazyLock<Mutex<HashMap<String, Capture>>> = LazyLock::new(Default::default);
+static GENERATION: AtomicU64 = AtomicU64::new(0);
+
+fn captures() -> std::sync::MutexGuard<'static, HashMap<String, Capture>> {
+  CAPTURES
+    .lock()
+    .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+/// Run `f` on the log of capture `generation`; `None` once it is gone.
+fn with_log<T>(
+  profile_id: &str,
+  generation: u64,
+  f: impl FnOnce(&mut CaptureLog) -> T,
+) -> Option<T> {
+  let mut captures = captures();
+  let capture = captures
+    .get_mut(profile_id)
+    .filter(|capture| capture.generation == generation)?;
+  Some(f(&mut capture.log))
+}
+
+/// Why a capture could not start.
+#[derive(Debug)]
+pub(crate) enum StartError {
+  /// The browser is not running on this computer.
+  NotLocal,
+  /// The browser refused, or did not answer, the attach.
+  Refused(String),
+}
+
+/// Start capturing a running profile's traffic. A capture already running is
+/// left as it is; the answer says so.
+pub(crate) async fn start(profile: &BrowserProfile) -> Result<Value, StartError> {
+  let profile_id = profile.id.to_string();
+  if let Some(capture) = captures().get(&profile_id) {
+    return Ok(json!({
+      "capturing": true,
+      "already_running": true,
+      "tabs": capture.log.tabs(),
+      "kept": capture.log.entries.len(),
+    }));
+  }
+  let connection = crate::cdp_target::connect_local_browser(profile)
+    .await
+    .ok_or(StartError::NotLocal)?;
+  let generation = GENERATION.fetch_add(1, Ordering::Relaxed) + 1;
+  let (go, wait_for_go) = tokio::sync::oneshot::channel::<()>();
+  let (ready, attached) = tokio::sync::oneshot::channel::<Result<(), String>>();
+  let pump_profile = profile_id.clone();
+  let task = tokio::spawn(async move {
+    if wait_for_go.await.is_ok() {
+      pump(pump_profile, generation, connection, ready).await;
+    }
+  });
+  {
+    let mut captures = captures();
+    if let Some(capture) = captures.get(&profile_id) {
+      // Another call started one while this one dialed.
+      task.abort();
+      return Ok(json!({
+        "capturing": true,
+        "already_running": true,
+        "tabs": capture.log.tabs(),
+        "kept": capture.log.entries.len(),
+      }));
+    }
+    captures.insert(
+      profile_id.clone(),
+      Capture {
+        generation,
+        log: CaptureLog::default(),
+        task: task.abort_handle(),
+      },
+    );
+  }
+  let _ = go.send(());
+  let outcome = match tokio::time::timeout(ATTACH_TIMEOUT, attached).await {
+    Ok(Ok(outcome)) => outcome,
+    Ok(Err(_)) => Err("the browser closed the connection".to_string()),
+    Err(_) => Err("the browser did not answer".to_string()),
+  };
+  if let Err(reason) = outcome {
+    end(&profile_id, generation);
+    return Err(StartError::Refused(reason));
+  }
+  log::info!("Network capture started profile={profile_id}");
+  let tabs = with_log(&profile_id, generation, |log| log.tabs()).unwrap_or_default();
+  Ok(json!({ "capturing": true, "already_running": false, "tabs": tabs }))
+}
+
+/// Remove capture `generation` and stop its pump.
+fn end(profile_id: &str, generation: u64) -> Option<CaptureLog> {
+  let mut captures = captures();
+  if captures
+    .get(profile_id)
+    .is_some_and(|capture| capture.generation == generation)
+  {
+    let capture = captures.remove(profile_id)?;
+    capture.task.abort();
+    return Some(capture.log);
+  }
+  None
+}
+
+/// Stop a profile's capture and forget what it saw. `None` when none ran.
+pub(crate) fn stop(profile_id: &str) -> Option<usize> {
+  let capture = captures().remove(profile_id)?;
+  capture.task.abort();
+  let kept = capture.log.entries.len();
+  log::info!("Network capture stopped profile={profile_id} requests={kept}");
+  Some(kept)
+}
+
+/// Read a profile's capture; `None` when none runs.
+pub(crate) fn read<T>(profile_id: &str, f: impl FnOnce(&CaptureLog) -> T) -> Option<T> {
+  captures().get(profile_id).map(|capture| f(&capture.log))
+}
+
+/// Carry events from the browser into the log, and the log's commands back.
+async fn pump(
+  profile_id: String,
+  generation: u64,
+  mut connection: CdpConnection,
+  ready: tokio::sync::oneshot::Sender<Result<(), String>>,
+) {
+  let mut ready = Some(ready);
+  let attach = connection
+    .send_to(
+      None,
+      ATTACH_ID,
+      "Target.setAutoAttach",
+      json!({
+        "autoAttach": true,
+        "waitForDebuggerOnStart": false,
+        "flatten": true,
+        "filter": [{ "type": "page" }],
+      }),
+    )
+    .await;
+  let mut next_id = ATTACH_ID + 1;
+  let mut fetches: HashMap<u64, u64> = HashMap::new();
+  let reason = match attach {
+    Err(e) => format!("attach failed: {e}"),
+    Ok(()) => 'pump: loop {
+      let text = match connection.next_text().await {
+        Some(Ok(text)) => text,
+        Some(Err(e)) => break e.to_string(),
+        None => break "browser closed".to_string(),
+      };
+      let Ok(message) = serde_json::from_str::<Value>(&text) else {
+        continue;
+      };
+      if let Some(id) = message.get("id").and_then(Value::as_u64) {
+        if id == ATTACH_ID {
+          let refused = message.get("error").map(Value::to_string);
+          if let Some(ready) = ready.take() {
+            let _ = ready.send(match &refused {
+              Some(error) => Err(error.clone()),
+              None => Ok(()),
+            });
+          }
+          if refused.is_some() {
+            break "attach refused".to_string();
+          }
+        } else if let Some(entry) = fetches.remove(&id) {
+          let result = match message.get("error") {
+            Some(_) => None,
+            None => message.get("result"),
+          };
+          if with_log(&profile_id, generation, |log| log.on_body(entry, result)).is_none() {
+            break "stopped".to_string();
+          }
+        }
+        continue;
+      }
+      let Some(method) = message.get("method").and_then(Value::as_str) else {
+        continue;
+      };
+      let session = message.get("sessionId").and_then(Value::as_str);
+      let params = message.get("params").unwrap_or(&Value::Null);
+      let private = method == "Network.requestWillBeSent"
+        && crate::agent_console::person_in_control(&profile_id);
+      let Some(commands) = with_log(&profile_id, generation, |log| {
+        log.on_event(session, method, params, private)
+      }) else {
+        break "stopped".to_string();
+      };
+      for command in commands {
+        let id = next_id;
+        next_id += 1;
+        if let Some(entry) = command.body_for {
+          if fetches.len() >= MAX_PENDING_FETCHES {
+            fetches.clear();
+          }
+          fetches.insert(id, entry);
+        }
+        if let Err(e) = connection
+          .send_to(
+            command.session.as_deref(),
+            id,
+            command.method,
+            command.params,
+          )
+          .await
+        {
+          break 'pump e.to_string();
+        }
+      }
+    },
+  };
+  if let Some(ready) = ready.take() {
+    let _ = ready.send(Err(reason.clone()));
+  }
+  if let Some(log) = end(&profile_id, generation) {
+    log::info!(
+      "Network capture ended profile={profile_id} requests={} reason=\"{reason}\"",
+      log.entries.len()
+    );
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  const PAGE: &str = "S1";
+
+  fn attached_page(log: &mut CaptureLog) -> Vec<Command> {
+    log.on_event(
+      None,
+      "Target.attachedToTarget",
+      &json!({
+        "sessionId": PAGE,
+        "targetInfo": { "targetId": "T1", "type": "page", "url": "about:blank" },
+        "waitingForDebugger": false,
+      }),
+      false,
+    )
+  }
+
+  fn request(log: &mut CaptureLog, id: &str, url: &str, private: bool) {
+    log.on_event(
+      Some(PAGE),
+      "Network.requestWillBeSent",
+      &json!({
+        "requestId": id,
+        "type": "Fetch",
+        "timestamp": 10.0,
+        "wallTime": 1_700_000_000.5,
+        "request": {
+          "url": url,
+          "method": "POST",
+          "headers": { "Content-Type": "application/json", "Authorization": "Bearer abc" },
+          "postData": "{\"q\":1}",
+          "hasPostData": true,
+        },
+      }),
+      private,
+    );
+  }
+
+  fn respond(log: &mut CaptureLog, id: &str, mime: &str) {
+    log.on_event(
+      Some(PAGE),
+      "Network.responseReceived",
+      &json!({
+        "requestId": id,
+        "type": "Fetch",
+        "response": {
+          "status": 200,
+          "statusText": "OK",
+          "mimeType": mime,
+          "protocol": "h2",
+          "headers": { "set-cookie": "sid=secret", "content-type": mime },
+        },
+      }),
+      false,
+    );
+  }
+
+  fn finish(log: &mut CaptureLog, id: &str, bytes: u64) -> Vec<Command> {
+    log.on_event(
+      Some(PAGE),
+      "Network.loadingFinished",
+      &json!({ "requestId": id, "timestamp": 10.25, "encodedDataLength": bytes }),
+      false,
+    )
+  }
+
+  #[test]
+  fn a_tab_is_attached_with_network_on_and_its_frames_followed() {
+    let mut log = CaptureLog::default();
+    let commands = attached_page(&mut log);
+    let methods: Vec<&str> = commands.iter().map(|c| c.method).collect();
+    assert_eq!(methods, ["Network.enable", "Target.setAutoAttach"]);
+    assert!(commands.iter().all(|c| c.session.as_deref() == Some(PAGE)));
+    assert_eq!(commands[1].params["filter"], json!([{ "type": "iframe" }]));
+
+    let frame = log.on_event(
+      Some(PAGE),
+      "Target.attachedToTarget",
+      &json!({
+        "sessionId": "S2",
+        "targetInfo": { "targetId": "F1", "type": "iframe" },
+        "waitingForDebugger": true,
+      }),
+      false,
+    );
+    assert_eq!(frame.len(), 3);
+    assert_eq!(frame[2].method, "Runtime.runIfWaitingForDebugger");
+    assert_eq!(log.sessions.get("S2").map(String::as_str), Some("T1"));
+    assert_eq!(log.tabs(), 1);
+
+    let worker = log.on_event(
+      None,
+      "Target.attachedToTarget",
+      &json!({ "sessionId": "S3", "targetInfo": { "targetId": "W", "type": "service_worker" } }),
+      false,
+    );
+    assert!(worker.is_empty());
+  }
+
+  #[test]
+  fn a_request_is_recorded_with_its_text_body_and_no_credentials() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "r1", "https://api.example/items", false);
+    respond(&mut log, "r1", "application/json");
+    let fetch = finish(&mut log, "r1", 120);
+    assert_eq!(
+      fetch,
+      vec![Command {
+        session: Some(PAGE.to_string()),
+        method: "Network.getResponseBody",
+        params: json!({ "requestId": "r1" }),
+        body_for: Some(1),
+      }]
+    );
+    log.on_body(
+      1,
+      Some(&json!({ "body": "{\"items\":[1,2]}", "base64Encoded": false })),
+    );
+
+    let detail = log.detail(1, true, 0, 1000).unwrap();
+    assert_eq!(detail["tab"], "T1");
+    assert_eq!(detail["method"], "POST");
+    assert_eq!(detail["status"], 200);
+    assert_eq!(detail["state"], "done");
+    assert_eq!(detail["ms"], 250.0);
+    assert_eq!(detail["started_at"], 1_700_000_000_500.0);
+    assert_eq!(detail["post_data"], "{\"q\":1}");
+    assert_eq!(detail["request_headers"]["Authorization"], REDACTED);
+    assert_eq!(
+      detail["request_headers"]["Content-Type"],
+      "application/json"
+    );
+    assert_eq!(detail["response_headers"]["set-cookie"], REDACTED);
+    assert_eq!(detail["body"]["text"], "{\"items\":[1,2]}");
+    assert_eq!(detail["body"]["next_offset"], Value::Null);
+    assert_eq!(log.body_bytes, 15);
+  }
+
+  #[test]
+  fn only_web_requests_are_recorded_and_none_while_the_person_is_in_control() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "r1", "data:text/plain,hi", false);
+    request(&mut log, "r2", "chrome-extension://abc/x.js", false);
+    request(&mut log, "r3", "https://bank.example/login", true);
+    assert!(log.entries.is_empty());
+    assert_eq!(log.withheld, 1);
+    // Its answer finds no entry and asks for nothing.
+    respond(&mut log, "r3", "text/html");
+    assert!(finish(&mut log, "r3", 10).is_empty());
+  }
+
+  #[test]
+  fn bodies_that_are_not_text_or_too_large_are_not_fetched() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "img", "https://cdn.example/a.png", false);
+    respond(&mut log, "img", "image/png");
+    assert!(finish(&mut log, "img", 10).is_empty());
+    request(&mut log, "big", "https://api.example/dump", false);
+    respond(&mut log, "big", "application/json");
+    assert!(finish(&mut log, "big", MAX_BODY_BYTES as u64 + 1).is_empty());
+    let list = log.list(&ListQuery {
+      limit: 10,
+      ..Default::default()
+    });
+    assert_eq!(list["requests"][0]["body"], "not text");
+    assert_eq!(list["requests"][1]["body"], "too large");
+
+    request(&mut log, "bin", "https://api.example/blob", false);
+    respond(&mut log, "bin", "text/plain");
+    finish(&mut log, "bin", 10);
+    log.on_body(3, Some(&json!({ "body": "AAEC", "base64Encoded": true })));
+    assert_eq!(log.entry(3).unwrap().body, Body::Skipped("binary"));
+  }
+
+  #[test]
+  fn a_redirect_ends_one_hop_and_starts_the_next() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "r1", "http://example.test/old", false);
+    log.on_event(
+      Some(PAGE),
+      "Network.requestWillBeSent",
+      &json!({
+        "requestId": "r1",
+        "type": "Document",
+        "timestamp": 10.1,
+        "request": { "url": "https://example.test/new", "method": "GET", "headers": {} },
+        "redirectResponse": { "status": 301, "headers": { "Location": "https://example.test/new" } },
+      }),
+      false,
+    );
+    let first = log.entry(1).unwrap();
+    assert_eq!(first.state, State::Redirected);
+    assert_eq!(first.status, Some(301));
+    assert_eq!(log.entry(2).unwrap().url, "https://example.test/new");
+    assert_eq!(
+      log.open.get(&(PAGE.to_string(), "r1".to_string())),
+      Some(&2)
+    );
+  }
+
+  #[test]
+  fn failures_and_closed_tabs_end_their_requests() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "r1", "https://blocked.example/", false);
+    log.on_event(
+      Some(PAGE),
+      "Network.loadingFailed",
+      &json!({ "requestId": "r1", "timestamp": 11.0, "errorText": "net::ERR_BLOCKED_BY_CLIENT", "blockedReason": "inspector" }),
+      false,
+    );
+    request(&mut log, "r2", "https://slow.example/", false);
+    log.on_event(
+      None,
+      "Target.detachedFromTarget",
+      &json!({ "sessionId": PAGE }),
+      false,
+    );
+    assert_eq!(log.entry(1).unwrap().state, State::Failed);
+    assert_eq!(
+      log.entry(1).unwrap().error.as_deref(),
+      Some("net::ERR_BLOCKED_BY_CLIENT (blocked: inspector)")
+    );
+    assert_eq!(log.entry(2).unwrap().state, State::Incomplete);
+    assert!(log.open.is_empty());
+    assert!(log.sessions.is_empty());
+    let failed = log.list(&ListQuery {
+      limit: 10,
+      failed: Some(true),
+      ..Default::default()
+    });
+    assert_eq!(failed["requests"].as_array().unwrap().len(), 1);
+  }
+
+  #[test]
+  fn old_requests_and_old_bodies_give_way() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    for n in 0..MAX_ENTRIES + 5 {
+      request(&mut log, &format!("r{n}"), "https://example.test/", false);
+    }
+    assert_eq!(log.entries.len(), MAX_ENTRIES);
+    assert_eq!(log.evicted, 5);
+    assert_eq!(log.entries.front().unwrap().id, 6);
+    assert_eq!(log.open.len(), MAX_ENTRIES);
+
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    let body = "x".repeat(MAX_BODY_BYTES);
+    let count = MAX_STORED_BODY_BYTES / MAX_BODY_BYTES + 1;
+    for n in 0..count {
+      let id = format!("b{n}");
+      request(&mut log, &id, "https://example.test/", false);
+      respond(&mut log, &id, "text/plain");
+      finish(&mut log, &id, 10);
+      log.on_body(n as u64 + 1, Some(&json!({ "body": body })));
+    }
+    assert!(log.body_bytes <= MAX_STORED_BODY_BYTES);
+    assert_eq!(
+      log.entry(1).unwrap().body,
+      Body::Skipped("dropped to stay under the memory limit")
+    );
+    assert!(matches!(
+      log.entry(count as u64).unwrap().body,
+      Body::Kept(_)
+    ));
+  }
+
+  #[test]
+  fn a_list_filters_and_pages() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    for (n, url) in [
+      "https://a.test/api/one",
+      "https://b.test/page",
+      "https://a.test/api/two",
+    ]
+    .iter()
+    .enumerate()
+    {
+      let id = format!("r{n}");
+      request(&mut log, &id, url, false);
+      respond(&mut log, &id, "application/json");
+      finish(&mut log, &id, 10);
+      log.on_body(
+        n as u64 + 1,
+        Some(&json!({ "body": format!("{{\"n\":{n}}}") })),
+      );
+    }
+    let page = log.list(&ListQuery {
+      limit: 1,
+      url_contains: Some("A.TEST/API".to_string()),
+      ..Default::default()
+    });
+    assert_eq!(page["requests"][0]["id"], 1);
+    assert_eq!(page["next_after"], 1);
+    let rest = log.list(&ListQuery {
+      after: 1,
+      limit: 1,
+      url_contains: Some("a.test/api".to_string()),
+      ..Default::default()
+    });
+    assert_eq!(rest["requests"][0]["id"], 3);
+    assert_eq!(rest["next_after"], Value::Null);
+    let by_body = log.list(&ListQuery {
+      limit: 10,
+      body_contains: Some("\"n\":1".to_string()),
+      ..Default::default()
+    });
+    assert_eq!(by_body["requests"].as_array().unwrap().len(), 1);
+    assert_eq!(by_body["requests"][0]["id"], 2);
+    assert_eq!(by_body["last_id"], 3);
+  }
+
+  #[test]
+  fn a_long_body_is_read_in_slices() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    request(&mut log, "r1", "https://example.test/", false);
+    respond(&mut log, "r1", "text/plain");
+    finish(&mut log, "r1", 10);
+    log.on_body(1, Some(&json!({ "body": "ab€cd" })));
+    let first = log.detail(1, true, 0, 3).unwrap();
+    assert_eq!(first["body"]["text"], "ab€");
+    assert_eq!(first["body"]["chars"], 5);
+    assert_eq!(first["body"]["next_offset"], 3);
+    let second = log.detail(1, true, 3, 3).unwrap();
+    assert_eq!(second["body"]["text"], "cd");
+    assert_eq!(second["body"]["next_offset"], Value::Null);
+    assert!(log
+      .detail(1, false, 0, 3)
+      .unwrap()
+      .get("body")
+      .unwrap()
+      .is_string());
+  }
+
+  #[test]
+  fn a_long_url_is_cut_in_a_list_and_whole_in_detail() {
+    let mut log = CaptureLog::default();
+    attached_page(&mut log);
+    let url = format!("https://example.test/{}", "é".repeat(400));
+    request(&mut log, "r1", &url, false);
+    let listed = log.list(&ListQuery {
+      limit: 1,
+      ..Default::default()
+    });
+    let shown = listed["requests"][0]["url"].as_str().unwrap();
+    assert!(shown.ends_with('…') && shown.len() <= LIST_URL_CHARS + 3);
+    assert_eq!(log.detail(1, false, 0, 1).unwrap()["url"], url);
+  }
+}
diff --git a/src/i18n/locales/de.json b/src/i18n/locales/de.json
index d203295b..60fd846e 100644
--- a/src/i18n/locales/de.json
+++ b/src/i18n/locales/de.json
@@ -970,6 +970,10 @@
             "label": "Netzwerk",
             "description": "Proxys, VPNs, IP-Wechsel und DNS-Regeln"
           },
+          "traffic": {
+            "label": "Datenverkehr",
+            "description": "Anfragen der Seiten aufzeichnen und lesen"
+          },
           "fingerprint": {
             "label": "Fingerabdruck",
             "description": "Das Gerät eines Profils lesen und ändern"
diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index 3ebcc722..bf700402 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -970,6 +970,10 @@
             "label": "Network",
             "description": "Proxies, VPNs, IP rotation and DNS rules"
           },
+          "traffic": {
+            "label": "Traffic",
+            "description": "Record and read the requests pages make"
+          },
           "fingerprint": {
             "label": "Fingerprint",
             "description": "Read and change a profile's device"
diff --git a/src/i18n/locales/es.json b/src/i18n/locales/es.json
index 84f26b03..7686dedb 100644
--- a/src/i18n/locales/es.json
+++ b/src/i18n/locales/es.json
@@ -979,6 +979,10 @@
             "label": "Red",
             "description": "Proxies, VPN, rotación de IP y reglas DNS"
           },
+          "traffic": {
+            "label": "Tráfico",
+            "description": "Grabar y leer las solicitudes de las páginas"
+          },
           "fingerprint": {
             "label": "Huella",
             "description": "Leer y cambiar el dispositivo de un perfil"
diff --git a/src/i18n/locales/fr.json b/src/i18n/locales/fr.json
index fa832dfb..6daa31ac 100644
--- a/src/i18n/locales/fr.json
+++ b/src/i18n/locales/fr.json
@@ -979,6 +979,10 @@
             "label": "Réseau",
             "description": "Proxys, VPN, rotation d'IP et règles DNS"
           },
+          "traffic": {
+            "label": "Trafic",
+            "description": "Enregistrer et lire les requêtes des pages"
+          },
           "fingerprint": {
             "label": "Empreinte",
             "description": "Lire et modifier l'appareil d'un profil"
diff --git a/src/i18n/locales/ja.json b/src/i18n/locales/ja.json
index b4739835..e2318319 100644
--- a/src/i18n/locales/ja.json
+++ b/src/i18n/locales/ja.json
@@ -970,6 +970,10 @@
             "label": "ネットワーク",
             "description": "プロキシ、VPN、IP の切り替え、DNS ルール"
           },
+          "traffic": {
+            "label": "通信",
+            "description": "ページのリクエストを記録して読む"
+          },
           "fingerprint": {
             "label": "フィンガープリント",
             "description": "プロファイルのデバイスの確認と変更"
diff --git a/src/i18n/locales/ko.json b/src/i18n/locales/ko.json
index ed6e273b..fbd30e11 100644
--- a/src/i18n/locales/ko.json
+++ b/src/i18n/locales/ko.json
@@ -970,6 +970,10 @@
             "label": "네트워크",
             "description": "프록시, VPN, IP 교체, DNS 규칙"
           },
+          "traffic": {
+            "label": "트래픽",
+            "description": "페이지의 요청을 기록하고 읽기"
+          },
           "fingerprint": {
             "label": "핑거프린트",
             "description": "프로필의 기기 확인 및 변경"
diff --git a/src/i18n/locales/pt.json b/src/i18n/locales/pt.json
index 0052501c..63e8e130 100644
--- a/src/i18n/locales/pt.json
+++ b/src/i18n/locales/pt.json
@@ -979,6 +979,10 @@
             "label": "Rede",
             "description": "Proxies, VPNs, rotação de IP e regras de DNS"
           },
+          "traffic": {
+            "label": "Tráfego",
+            "description": "Gravar e ler as requisições das páginas"
+          },
           "fingerprint": {
             "label": "Impressão digital",
             "description": "Ler e alterar o dispositivo de um perfil"
diff --git a/src/i18n/locales/ru.json b/src/i18n/locales/ru.json
index 9bbc68a2..2f1a56b1 100644
--- a/src/i18n/locales/ru.json
+++ b/src/i18n/locales/ru.json
@@ -988,6 +988,10 @@
             "label": "Сеть",
             "description": "Прокси, VPN, смена IP и правила DNS"
           },
+          "traffic": {
+            "label": "Трафик",
+            "description": "Запись и чтение запросов страниц"
+          },
           "fingerprint": {
             "label": "Отпечаток",
             "description": "Просмотр и изменение устройства профиля"
diff --git a/src/i18n/locales/tr.json b/src/i18n/locales/tr.json
index cce3b9d0..d45b4109 100644
--- a/src/i18n/locales/tr.json
+++ b/src/i18n/locales/tr.json
@@ -970,6 +970,10 @@
             "label": "Ağ",
             "description": "Proxy'ler, VPN'ler, IP değiştirme ve DNS kuralları"
           },
+          "traffic": {
+            "label": "Trafik",
+            "description": "Sayfaların isteklerini kaydetme ve okuma"
+          },
           "fingerprint": {
             "label": "Parmak izi",
             "description": "Bir profilin cihazını okuma ve değiştirme"
diff --git a/src/i18n/locales/vi.json b/src/i18n/locales/vi.json
index 1cc3dd83..30f95b16 100644
--- a/src/i18n/locales/vi.json
+++ b/src/i18n/locales/vi.json
@@ -970,6 +970,10 @@
             "label": "Mạng",
             "description": "Proxy, VPN, đổi IP và quy tắc DNS"
           },
+          "traffic": {
+            "label": "Lưu lượng",
+            "description": "Ghi và đọc các yêu cầu của trang"
+          },
           "fingerprint": {
             "label": "Dấu vân tay",
             "description": "Xem và đổi thiết bị của profile"
diff --git a/src/i18n/locales/zh.json b/src/i18n/locales/zh.json
index f5d92729..7258db57 100644
--- a/src/i18n/locales/zh.json
+++ b/src/i18n/locales/zh.json
@@ -970,6 +970,10 @@
             "label": "网络",
             "description": "代理、VPN、IP 轮换和 DNS 规则"
           },
+          "traffic": {
+            "label": "流量",
+            "description": "记录并读取页面发出的请求"
+          },
           "fingerprint": {
             "label": "指纹",
             "description": "查看和修改配置文件的设备"
diff --git a/src/lib/mcp.ts b/src/lib/mcp.ts
index 37fd7b3d..a99092b4 100644
--- a/src/lib/mcp.ts
+++ b/src/lib/mcp.ts
@@ -24,6 +24,7 @@ export type AgentCategory = "desktop-app" | "cli" | "editor" | "editor-ext";
 export const OPTIONAL_TOOLSETS = [
   "organize",
   "network",
+  "traffic",
   "fingerprint",
   "extensions",
   "cookies",