@@ -15,6 +15,7 @@ on:
       - 'apps/sim/lib/api/contracts/mothership-chat-context.ts'
       - 'apps/sim/proxy.ts'
       - 'apps/sim/next.config.ts'
+      - 'apps/sim/package.json'
       - 'packages/emcn/**'
       - 'bun.lock'
   workflow_dispatch:
 
@@ -11,10 +11,11 @@ and workspace authorization. A conversation can continue in the full app.
 
 The user signs in in a normal Sim tab, chooses a workspace, opens or creates a
 conversation, and explicitly attaches the current page or highlighted text.
-Pending snapshots sit beside the composer as compact removable attachments. Opening one
+The composer’s + menu offers Current page and Selected text. Pending snapshots sit
+inside the composer as compact removable chips alongside file attachments. Opening one
 shows the captured text, source, capture time, and conversation-retention disclosure.
 Partial captures remain labeled in the attachment row. Site access lives in the
-extension options menu; successful delivery adds no persistent status banner.
+composer’s Site access action, which opens an extension-owned dialog; successful delivery adds no persistent status banner.
 They are immutable: navigating to another page cannot silently change an attached
 source. Removing an attachment, changing workspace, or starting a new conversation
 clears pending page context. Several explicitly attached pages can support comparison.
 
@@ -13,7 +13,7 @@ bun run --cwd apps/extension build
 
 In Chrome, open `chrome://extensions`, enable Developer mode, choose **Load unpacked**, and select `apps/extension/dist`. Copy the extension ID into the Sim server's `BROWSER_EXTENSION_IDS` configuration. It accepts comma-separated Chrome extension IDs. Restart the app after changing that configuration. Unconfigured IDs cannot embed the app.
 
-Click the Sim toolbar icon to open chat and attach the current page. **Attach page** adds a fresh snapshot. Attach up to three pages or selections to summarize, extract facts, or compare sources. To quote a passage, select it and choose **Ask Sim about selection** from the context menu. Review or remove the attachment before sending. The **Extension options** menu keeps site permissions out of the chat: **Allow access to [site]** grants access only to that site; **Remove access to [site]** revokes it. Persistent site permission never enables background capture.
+Click the Sim toolbar icon to open chat and attach the current page. **+ → Current page** adds a fresh snapshot; **Selected text** attaches the highlighted passage. Attachments appear as chips inside the composer. Attach up to three pages or selections to summarize, extract facts, or compare sources. To quote a passage, select it and choose **Ask Sim about selection** from the context menu. Review or remove the attachment before sending. **+ → Site access** opens the extension-owned permission dialog: **Allow access to [site]** grants access only to that site; **Remove access to [site]** revokes it. Persistent site permission never enables background capture.
 
 For local development:
 
@@ -32,7 +32,7 @@ SIM_EXTENSION_DEV=1 SIM_EXTENSION_ORIGIN=http://localhost:3000 bun run --cwd app
 - Source URLs omit credentials, query parameters, and fragments. Human-readable text can still contain sensitive information; it is the user-selected material they review and send into their conversation.
 - Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. Extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
 - No browser history, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
-- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted page may acknowledge readiness and receipt; it cannot request privileged browser actions through the bridge.
+- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, or the native site-access dialog. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned dialog.
 - Captures and queued toolbar intents are scoped to the receiving conversation. Changing conversation, workspace, or account discards an unfinished handoff. Captured attachments remain explicit snapshots when the source tab changes.
 - The complete hosted document, including portaled source dialogs and menus, is blocked from session replay. Clipboard writing is delegated only to the configured Sim origin. Clipboard reading and microphone capture are not delegated; voice input remains available in the main app.
 
@@ -44,7 +44,7 @@ EXTENSION_REPORT_PATH=test-results/extension-report.json bun run --cwd apps/exte
 bun run --cwd apps/extension build
 ```
 
-The E2E suite uses real Chromium, the packaged extension, and a disposable HTTP app fixture. It pregrants only the fixture page origin in a temporary package to exercise extraction without automating the browser's permission dialog. It checks HttpOnly session-cookie transport, origin/frame spoofing, sensitive-field exclusion, source URL minimization, selected excerpts, UTF-8 limits, stale-document handoffs, denied host access, and absence of page bytes in extension storage. The cookie check uses a fixture, not Better Auth or SSO. JSON results and a screenshot are written beside the caller-supplied report path. The E2E build points `dist` at its temporary fixture origin; rebuild normally before loading or distributing it.
+The E2E suite uses real Chromium, the packaged extension, and a disposable HTTP app fixture. It pregrants only the fixture page origin in a temporary package to exercise extraction without automating the browser's permission dialog. It checks HttpOnly session-cookie transport, origin/frame spoofing, sensitive-field exclusion, source URL minimization, selected excerpts, UTF-8 limits, stale-document handoffs, denied host access, and absence of page bytes in extension storage. The cookie check uses a fixture, not Better Auth or SSO. JSON results and a screenshot are written beside the caller-supplied report path. The E2E suite builds into a temporary directory and leaves shipping `dist` untouched.
 
 Release verification must additionally exercise the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
 
@@ -58,7 +58,7 @@ SIM_EXTENSION_KEY="$PUBLIC_EXTENSION_KEY" \
 bun run --cwd apps/sim test:browser-extension:e2e
 ```
 
-Configure the matching extension ID in the running app. The suite creates its own accounts/workspaces and removes them afterward. It verifies real authentication, workspace denial, page limits, navigation, source links, clipboard writes, actual replay-recorder exclusion, themes, widths, and sign-out. CI provisions this environment automatically. Set `EXTENSION_APP_E2E_LIVE_CHAT=1` when the app is connected to a working local Mothership instance to additionally verify live rendering, saved page context, queue editing, and drafts through chat admission. Provider credentials belong only in that server's environment. Reports and screenshots are written beside the supplied report path. Native toolbar/shortcut/context-menu and permission-prompt checks remain manual release checks.
+Configure the matching extension ID in the running app. The suite builds into a temporary directory, creates its own accounts/workspaces, and removes them afterward; it leaves the shipping `dist` untouched. It verifies real authentication, workspace denial, page limits, navigation, source links, clipboard writes, actual replay-recorder exclusion, themes, widths, and sign-out. CI provisions this isolated environment with `next dev`; the main checks workflow separately validates the production build. This keeps the disposable extension origin and identity independent of the shared app build. Set `EXTENSION_APP_E2E_LIVE_CHAT=1` when the app is connected to a working local Mothership instance to additionally verify live rendering, saved page context, queue editing, and drafts through chat admission. Provider credentials belong only in that server's environment. Reports and screenshots are written beside the supplied report path. Native toolbar/shortcut/context-menu and permission-prompt checks remain manual release checks.
 
 ## Distribution
 
 
@@ -1,3 +1,4 @@
+import { createPublicKey } from 'node:crypto'
 import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -22,11 +23,26 @@ if (
   )
 }
 const key = process.env.SIM_EXTENSION_KEY
-if (key && (!/^[A-Za-z0-9+/]+={0,2}$/.test(key) || key.length > 4_096))
-  throw new Error('SIM_EXTENSION_KEY must be a base64 public key.')
+if (key) {
+  try {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(key) || key.length > 4_096)
+      throw new Error('Invalid encoding')
+    const parsed = createPublicKey({ key: Buffer.from(key, 'base64'), format: 'der', type: 'spki' })
+    if (
+      parsed.asymmetricKeyType !== 'rsa' ||
+      parsed.export({ format: 'der', type: 'spki' }).toString('base64') !== key
+    )
+      throw new Error('Invalid public key')
+  } catch {
+    throw new Error('SIM_EXTENSION_KEY must be a base64 RSA public key in SPKI format.')
+  }
+}
 
-const dist = resolve(root, 'dist')
-await rm(dist, { recursive: true, force: true })
+const outputArgument = process.argv.find((argument) => argument.startsWith('--outdir='))
+const outputDirectory = outputArgument?.slice('--outdir='.length)
+if (outputArgument && !outputDirectory) throw new Error('--outdir requires a directory.')
+const dist = resolve(root, outputDirectory ?? 'dist')
+if (!outputArgument) await rm(dist, { recursive: true, force: true })
 await mkdir(dist, { recursive: true })
 await build({
   absWorkingDir: root,
 
@@ -1,9 +1,11 @@
 import { spawnSync } from 'node:child_process'
-import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { generateKeyPairSync } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { type BrowserContext, chromium, type Frame, type Page } from '@playwright/test'
+import { type BrowserContext, chromium, expect, type Frame, type Page } from '@playwright/test'
 import { pageSnapshotSchema } from '@sim/browser-extension-protocol'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
@@ -83,15 +85,32 @@ async function check(name: string, run: () => Promise<void>) {
 }
 
 try {
+  await check('The build rejects private key material before creating output', async () => {
+    const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+    const rejectedOutput = resolve(temporary, 'rejected-key')
+    const result = spawnSync(process.execPath, ['scripts/build.ts', `--outdir=${rejectedOutput}`], {
+      cwd: root,
+      env: {
+        ...process.env,
+        SIM_EXTENSION_KEY: privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),
+      },
+      encoding: 'utf8',
+    })
+    assert(result.status !== 0, 'The build accepted private key material')
+    assert(
+      result.stderr.includes('RSA public key in SPKI format'),
+      'The build failed for an unrelated reason'
+    )
+    assert(!existsSync(rejectedOutput), 'Invalid key material reached build output')
+  })
   const origin = `http://127.0.0.1:${fixture.port}`
   const pageOrigin = `http://localhost:${fixture.port}`
-  const built = spawnSync(process.execPath, ['scripts/build.ts'], {
+  const built = spawnSync(process.execPath, ['scripts/build.ts', `--outdir=${extensionPath}`], {
     cwd: root,
     env: { ...process.env, SIM_EXTENSION_ORIGIN: origin, SIM_EXTENSION_DEV: '1' },
     encoding: 'utf8',
   })
   assert(built.status === 0, `Extension build failed: ${built.stderr}`)
-  await cp(resolve(root, 'dist'), extensionPath, { recursive: true })
   const manifest = JSON.parse(await readFile(resolve(extensionPath, 'manifest.json'), 'utf8'))
   // The test package pregrants its disposable fixture site, equivalent to an accepted site prompt.
   manifest.host_permissions.push(`${pageOrigin}/*`)
@@ -109,7 +128,7 @@ try {
   await signIn.close()
   const panel: Page = await context.newPage()
   await panel.goto(`chrome-extension://${extensionId}/sidepanel.html`)
-  await panel.getByRole('button', { name: 'Attach page', exact: true }).waitFor()
+  await panel.getByTitle('Sim chat').waitFor()
   const frame: Frame = panel.frames()[1] ?? (await panel.waitForEvent('frameattached'))
   const app = panel.frames().find((candidate) => candidate.url().startsWith(origin)) ?? frame
   assert(app, 'Hosted frame did not load')
@@ -123,18 +142,38 @@ try {
   const page = await context.newPage()
   await page.goto(`${pageOrigin}/ticket?access_token=URL_SECRET#secret`)
   await page.bringToFront()
-  const capture = (name = 'Attach page') =>
-    panel
-      .getByRole('button', { name, exact: true })
-      .evaluate((button) => (button as HTMLButtonElement).click())
+  let receiverReady = false
+  const capture = async (name = 'Attach page') => {
+    if (!receiverReady) {
+      const intent = await pendingIntent()
+      await worker.evaluate(async (intent) => {
+        await chrome.storage.session.set({ [`captureIntent:${intent.windowId}:initial`]: intent })
+      }, intent)
+      return
+    }
+    await app.evaluate(
+      ({ sessionId, action, origin }) => {
+        parent.postMessage(
+          { channel: 'sim-extension', version: 1, type: 'action', sessionId, action },
+          origin
+        )
+      },
+      {
+        sessionId: receiverSessionId,
+        action: name === 'Selection' ? 'capture-selection' : 'capture-page',
+        origin: `chrome-extension://${extensionId}`,
+      }
+    )
+  }
   const snapshots = async () =>
     pageSnapshotSchema.array().parse(JSON.parse(await app.locator('#received').innerText()))
   let receiverSessionId = generateId()
   await app.evaluate((sessionId) => {
     document.body.dataset.sessionId = sessionId
   }, receiverSessionId)
-  const ready = () =>
-    app.evaluate(
+  const ready = () => {
+    receiverReady = true
+    return app.evaluate(
       ({ targetOrigin, sessionId }) => {
         document.body.dataset.sessionId = sessionId
         parent.postMessage(
@@ -144,6 +183,7 @@ try {
       },
       { targetOrigin: `chrome-extension://${extensionId}`, sessionId: receiverSessionId }
     )
+  }
   const pendingIntent = () =>
     worker.evaluate(async () => {
       const [tab] = await chrome.tabs.query({ active: true, currentWindow: true })
@@ -210,8 +250,6 @@ try {
     await page.evaluate(() => {
       document.body.textContent = 'SECOND_CAPTURE_SENTINEL'
     })
-    await capture()
-    await panel.getByRole('status').filter({ hasText: 'previous capture' }).waitFor()
     await ready()
     await panel.waitForFunction(() => document.querySelector('[role="status"]')?.textContent === '')
     assert(
@@ -475,6 +513,104 @@ try {
     assert((await snapshots()).length === 5, 'Unvalidated selection ancestors were traversed')
     await page.reload()
   })
+  await check('Unicode and escaped text fit within the complete snapshot budget', async () => {
+    await page.goto(`${pageOrigin}/${'a'.repeat(4_000)}`)
+    await page.evaluate(() => {
+      document.title = '"'.repeat(512)
+      document.body.textContent = '界'.repeat(45_000) + '"'.repeat(5_000)
+    })
+    const before = (await snapshots()).length
+    await capture()
+    await app.waitForFunction(
+      (count) =>
+        JSON.parse(document.getElementById('received')?.textContent ?? '[]').length === count,
+      before + 1
+    )
+    const snapshot = pageSnapshotSchema.parse((await snapshots()).at(-1))
+    assert(snapshot.truncated, 'Oversized serialized text was not marked partial')
+    assert(
+      snapshot.text.startsWith('界') && snapshot.text.includes('"'),
+      'Capture lost the expected page content'
+    )
+  })
+  await check(
+    'Composer capture requests require a current user gesture and conversation',
+    async () => {
+      const before = (await snapshots()).length
+      await panel.evaluate(() => {
+        let queries = 0
+        let actions = 0
+        const originalQuery = chrome.tabs.query.bind(chrome.tabs)
+        chrome.tabs.query = ((
+          query: chrome.tabs.QueryInfo,
+          callback?: (tabs: chrome.tabs.Tab[]) => void
+        ) => {
+          queries++
+          return callback ? originalQuery(query, callback) : originalQuery(query)
+        }) as typeof chrome.tabs.query
+        window.addEventListener('message', (event: MessageEvent<unknown>) => {
+          if (
+            event.source !== document.querySelector('iframe')?.contentWindow ||
+            typeof event.data !== 'object' ||
+            event.data === null ||
+            !('type' in event.data) ||
+            event.data.type !== 'action'
+          )
+            return
+          document.body.dataset.actionQueries = String(queries)
+          document.body.dataset.observedActions = String(++actions)
+        })
+      })
+      const parentCdp = await panel.context().newCDPSession(panel)
+      const cdp = await panel.context().newCDPSession(app)
+      await expect
+        .poll(
+          async () => {
+            const result = await parentCdp.send('Runtime.evaluate', {
+              expression: 'navigator.userActivation.isActive',
+              userGesture: false,
+            })
+            return result.result.value
+          },
+          { timeout: 10_000 }
+        )
+        .toBe(false)
+      const action = {
+        channel: 'sim-extension',
+        version: 1,
+        type: 'action',
+        sessionId: receiverSessionId,
+        action: 'capture-page',
+      }
+      await cdp.send('Runtime.evaluate', {
+        expression: `parent.postMessage(${JSON.stringify(action)}, ${JSON.stringify(`chrome-extension://${extensionId}`)})`,
+        userGesture: false,
+      })
+      await expect(panel.locator('body')).toHaveAttribute('data-observed-actions', '1')
+      await expect(panel.locator('body')).toHaveAttribute('data-action-queries', '0')
+      assert((await snapshots()).length === before, 'Captured without a user gesture')
+      await app.evaluate(({ action, targetOrigin }) => parent.postMessage(action, targetOrigin), {
+        action: { ...action, sessionId: generateId() },
+        targetOrigin: `chrome-extension://${extensionId}`,
+      })
+      await expect(panel.locator('body')).toHaveAttribute('data-observed-actions', '2')
+      await expect(panel.locator('body')).toHaveAttribute('data-action-queries', '0')
+      assert((await snapshots()).length === before, 'Captured for an obsolete conversation')
+      await capture()
+      await app.waitForFunction(
+        (count) =>
+          JSON.parse(document.getElementById('received')?.textContent ?? '[]').length === count,
+        before + 1
+      )
+      await expect(panel.locator('body')).toHaveAttribute('data-observed-actions', '3')
+      assert(
+        Number(await panel.locator('body').getAttribute('data-action-queries')) > 0,
+        'Allowed capture did not reach the browser API'
+      )
+      await cdp.detach()
+      await parentCdp.detach()
+    }
+  )
   await mkdir(dirname(output), { recursive: true })
   await panel.screenshot({ path: output.replace(/\.json$/, '.png'), fullPage: true })
 } catch (error) {