Initial release of File Tools 0.1.0

.gitignore

@@ -0,0 +1,9 @@
+node_modules/
+dist/
+release/*.zip
+release/*.zip.sha256
+coverage/
+playwright-report/
+test-results/
+*.tsbuildinfo
+.DS_Store

.npmrc

@@ -0,0 +1 @@
+@add-ideas:registry=https://git.add-ideas.de/api/packages/lotobo/npm/

CHANGELOG.md

@@ -0,0 +1,6 @@
+# Changelog
+
+## 0.1.0 - 2026-09-01
+
+- Added the initial local-first File Tools workbench.
+- Added Toolbox integration, bounded input handling, offline shell and deterministic release packaging.

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+Run `npm ci`, `npm run check`, and `npm run test:browser` before proposing a change. Keep processing local, preserve explicit limits, and include fixtures for every parser boundary.

LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

LICENSES/README.md

@@ -0,0 +1,3 @@
+# Licences
+
+The application is GPL-3.0-or-later. Generated release artifacts include an exact runtime dependency licence inventory in `npm-runtime-licenses.txt`.

README.md

@@ -0,0 +1,32 @@
+# File Tools
+
+Identify, inspect and inventory local files in the browser.
+
+File Tools is a standalone local-first application in the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal). Inputs are processed in the browser and are not uploaded.
+
+## Version 0.1 scope
+
+- Bounded head/tail signature inspection with claimed-versus-detected MIME reporting
+- Paged 512-byte hexadecimal/ASCII views plus bounded UTF-8 and extracted-string previews
+- Streaming SHA-256 and SHA-512 hashing in a cancellable module worker
+- Same-size and same-hash duplicate candidates plus deterministic JSON/CSV inventory manifests
+
+Detection and entropy results are heuristics, not format validation, malware analysis or proof of encryption. A selection is limited to 500 entries; file contents remain represented by browser `File` handles and are read only for an inspection window, the visible hex window, or an explicitly requested streaming hash. File mutation, split/join and batch rename are not part of version 0.1. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
+
+## Development
+
+Requires Node.js 22 and npm 11.
+
+```sh
+npm ci
+npm run check
+npm run test:browser
+```
+
+## Release
+
+`npm run release:artifact` creates a deterministic `release/file-tools-0.1.0.zip` and checksum sidecar.
+
+## Licence
+
+GPL-3.0-or-later. Runtime dependencies retain their own licences; see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

SECURITY.md

@@ -0,0 +1,3 @@
+# Security
+
+Please report vulnerabilities privately to the repository owner. Do not attach sensitive source files to public issues. Imported inputs are untrusted; parsers must remain bounded and must not execute active content or fetch external resources.

SOURCE.md

@@ -0,0 +1,7 @@
+# Corresponding source
+
+The corresponding source for File Tools 0.1.0 is available at:
+
+https://git.add-ideas.de/lotobo/file-tools/src/tag/v0.1.0
+
+Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`.

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,15 @@
+# Third-party notices
+
+File Tools 0.1.0 directly depends on these runtime packages:
+
+| Package                          | Pinned version | Declared licence |
+| -------------------------------- | -------------: | ---------------- |
+| `@add-ideas/toolbox-contract`    |          0.2.3 | Apache-2.0       |
+| `@add-ideas/toolbox-helpers`     |          0.1.0 | GPL-3.0-or-later |
+| `@add-ideas/toolbox-shell-react` |          0.2.3 | Apache-2.0       |
+| `@noble/hashes`                  |          2.4.0 | MIT              |
+| `file-type`                      |         22.0.2 | MIT              |
+| `react`                          |         19.2.8 | MIT              |
+| `react-dom`                      |         19.2.8 | MIT              |
+
+This table covers direct production dependencies, not transitive packages or development tooling. During a release build, the exact non-development dependency tree and discovered licence texts are generated from the lockfile into `LICENSES/npm-runtime-licenses.txt` and included in the release ZIP. Copyright and licence terms remain with their respective authors.

docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings and labelled native controls, supports keyboard operation, visible focus, reduced-width layouts, and system/light/dark themes through the Toolbox shell. Results do not rely on colour alone.

docs/ARCHITECTURE.md

@@ -0,0 +1,7 @@
+# Architecture
+
+File Tools is a static React/Vite application wrapped in the shared Toolbox shell. Browser `File` handles and small metadata records remain on the main thread; one fresh module worker performs each inspection or streaming hash and is terminated on completion, cancellation, timeout, replacement or unmount.
+
+The worker reads at most 1 MiB from each end for signature, entropy, text and string heuristics. SHA-256 and SHA-512 are updated together in 1 MiB chunks, so hashing does not buffer the complete file. The hex view independently reads one 512-byte window. `file/signatures.ts` contains project-owned evidence heuristics; `file-type` provides broader signature hints; `@noble/hashes` provides incremental hashes.
+
+`file/manifest.ts` sorts by path and emits JSON or spreadsheet-neutralised CSV. Duplicate groups start as same-size candidates and become stronger same-hash candidates after explicit hashing; no deletion or mutation follows. Relative worker and asset URLs keep the build relocatable below a nested portal path.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,7 @@
+# Privacy and security
+
+Selected files remain browser `File` objects and are never uploaded. There is no telemetry, analytics, account, persistence or runtime network path. A selection is limited to 500 entries. Inspection reads bounded samples, the hex view reads one window, and hashing streams the selected file only after an explicit action.
+
+Worker jobs are isolated from the UI thread and are terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
+
+Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence but the app does not delete, rename, split, join or otherwise mutate files.

eslint.config.mjs

@@ -0,0 +1,37 @@
+import js from "@eslint/js";
+import globals from "globals";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: [
+      "dist",
+      "release",
+      "coverage",
+      "test-results",
+      "playwright-report",
+    ],
+  },
+  {
+    extends: [js.configs.recommended, ...tseslint.configs.recommended],
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      ecmaVersion: 2023,
+      globals: { ...globals.browser, ...globals.worker },
+    },
+    plugins: { "react-hooks": reactHooks, "react-refresh": reactRefresh },
+    rules: {
+      ...reactHooks.configs.recommended.rules,
+      "react-refresh/only-export-components": [
+        "warn",
+        { allowConstantExport: true },
+      ],
+    },
+  },
+  {
+    files: ["scripts/**/*.mjs", "playwright.config.ts"],
+    languageOptions: { globals: globals.node },
+  },
+);

index.html

@@ -0,0 +1,19 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta
+      name="description"
+      content="Identify, inspect and inventory local files in the browser."
+    />
+    <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
+    <link rel="manifest" href="./manifest.webmanifest" />
+    <meta name="theme-color" content="#29255f" />
+    <title>File Tools</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./src/main.tsx"></script>
+  </body>
+</html>

package.json

@@ -0,0 +1,73 @@
+{
+  "name": "file-tools",
+  "version": "0.1.0",
+  "description": "Identify, inspect and inventory local files in the browser.",
+  "license": "GPL-3.0-or-later",
+  "author": "Albrecht Degering",
+  "repository": {
+    "type": "git",
+    "url": "git+https://git.add-ideas.de/lotobo/file-tools.git"
+  },
+  "homepage": "https://git.add-ideas.de/lotobo/file-tools",
+  "bugs": {
+    "url": "https://git.add-ideas.de/lotobo/file-tools/issues"
+  },
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "predev": "npm run manifest:generate",
+    "dev": "vite",
+    "prebuild": "npm run release:prepare && npm run manifest:generate",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc -b --pretty false",
+    "lint": "eslint . --max-warnings=0",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:browser": "playwright test",
+    "manifest:generate": "node scripts/generate-toolbox-manifest.mjs",
+    "manifest:check": "node scripts/generate-toolbox-manifest.mjs --check",
+    "release:prepare": "node scripts/prepare-release-files.mjs",
+    "toolbox:check": "toolbox-check dist",
+    "package:release": "node scripts/package-release.mjs",
+    "check": "npm run manifest:check && npm run typecheck && npm run lint && npm run format:check && npm run test && npm run build && npm run toolbox:check",
+    "release:artifact": "npm run check && npm run test:browser && npm run package:release -- --force"
+  },
+  "dependencies": {
+    "@add-ideas/toolbox-contract": "0.2.3",
+    "@add-ideas/toolbox-helpers": "0.1.0",
+    "@add-ideas/toolbox-shell-react": "0.2.3",
+    "@noble/hashes": "2.4.0",
+    "file-type": "22.0.2",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
+  },
+  "devDependencies": {
+    "@add-ideas/toolbox-testkit": "0.2.3",
+    "@eslint/js": "10.0.1",
+    "@playwright/test": "1.62.1",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.1",
+    "@types/node": "25.9.5",
+    "@types/react": "19.2.17",
+    "@types/react-dom": "19.2.5",
+    "@vitejs/plugin-react": "6.0.3",
+    "eslint": "10.7.0",
+    "eslint-plugin-react-hooks": "7.1.1",
+    "eslint-plugin-react-refresh": "0.5.2",
+    "globals": "17.7.0",
+    "jsdom": "29.1.1",
+    "prettier": "3.9.5",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.64.0",
+    "vite": "8.2.2",
+    "vitest": "4.1.11"
+  },
+  "packageManager": "npm@11.17.0"
+}

playwright.config.ts

@@ -0,0 +1,21 @@
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests/browser",
+  fullyParallel: false,
+  workers: 1,
+  timeout: 120_000,
+  expect: { timeout: 10_000 },
+  reporter: [["list"]],
+  use: { baseURL: "http://127.0.0.1:4173", trace: "retain-on-failure" },
+  webServer: {
+    command: "npm run build && node scripts/serve-test.mjs",
+    url: "http://127.0.0.1:4173",
+    reuseExistingServer: !process.env.CI,
+    timeout: 180_000,
+  },
+  projects: [
+    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
+    { name: "firefox", use: { ...devices["Desktop Firefox"] } },
+  ],
+});

public/CHANGELOG.md

@@ -0,0 +1,6 @@
+# Changelog
+
+## 0.1.0 - 2026-09-01
+
+- Added the initial local-first File Tools workbench.
+- Added Toolbox integration, bounded input handling, offline shell and deterministic release packaging.

public/CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+Run `npm ci`, `npm run check`, and `npm run test:browser` before proposing a change. Keep processing local, preserve explicit limits, and include fixtures for every parser boundary.

public/LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

public/LICENSES/README.md

@@ -0,0 +1,3 @@
+# Licences
+
+The application is GPL-3.0-or-later. Generated release artifacts include an exact runtime dependency licence inventory in `npm-runtime-licenses.txt`.

public/README.md

@@ -0,0 +1,32 @@
+# File Tools
+
+Identify, inspect and inventory local files in the browser.
+
+File Tools is a standalone local-first application in the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal). Inputs are processed in the browser and are not uploaded.
+
+## Version 0.1 scope
+
+- Bounded head/tail signature inspection with claimed-versus-detected MIME reporting
+- Paged 512-byte hexadecimal/ASCII views plus bounded UTF-8 and extracted-string previews
+- Streaming SHA-256 and SHA-512 hashing in a cancellable module worker
+- Same-size and same-hash duplicate candidates plus deterministic JSON/CSV inventory manifests
+
+Detection and entropy results are heuristics, not format validation, malware analysis or proof of encryption. A selection is limited to 500 entries; file contents remain represented by browser `File` handles and are read only for an inspection window, the visible hex window, or an explicitly requested streaming hash. File mutation, split/join and batch rename are not part of version 0.1. See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and [docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md).
+
+## Development
+
+Requires Node.js 22 and npm 11.
+
+```sh
+npm ci
+npm run check
+npm run test:browser
+```
+
+## Release
+
+`npm run release:artifact` creates a deterministic `release/file-tools-0.1.0.zip` and checksum sidecar.
+
+## Licence
+
+GPL-3.0-or-later. Runtime dependencies retain their own licences; see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

public/SECURITY.md

@@ -0,0 +1,3 @@
+# Security
+
+Please report vulnerabilities privately to the repository owner. Do not attach sensitive source files to public issues. Imported inputs are untrusted; parsers must remain bounded and must not execute active content or fetch external resources.

public/SOURCE.md

@@ -0,0 +1,7 @@
+# Corresponding source
+
+The corresponding source for File Tools 0.1.0 is available at:
+
+https://git.add-ideas.de/lotobo/file-tools/src/tag/v0.1.0
+
+Build with Node.js 22, npm 11, `npm ci`, and `npm run release:artifact`.

public/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,15 @@
+# Third-party notices
+
+File Tools 0.1.0 directly depends on these runtime packages:
+
+| Package                          | Pinned version | Declared licence |
+| -------------------------------- | -------------: | ---------------- |
+| `@add-ideas/toolbox-contract`    |          0.2.3 | Apache-2.0       |
+| `@add-ideas/toolbox-helpers`     |          0.1.0 | GPL-3.0-or-later |
+| `@add-ideas/toolbox-shell-react` |          0.2.3 | Apache-2.0       |
+| `@noble/hashes`                  |          2.4.0 | MIT              |
+| `file-type`                      |         22.0.2 | MIT              |
+| `react`                          |         19.2.8 | MIT              |
+| `react-dom`                      |         19.2.8 | MIT              |
+
+This table covers direct production dependencies, not transitive packages or development tooling. During a release build, the exact non-development dependency tree and discovered licence texts are generated from the lockfile into `LICENSES/npm-runtime-licenses.txt` and included in the release ZIP. Copyright and licence terms remain with their respective authors.

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings and labelled native controls, supports keyboard operation, visible focus, reduced-width layouts, and system/light/dark themes through the Toolbox shell. Results do not rely on colour alone.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,7 @@
+# Architecture
+
+File Tools is a static React/Vite application wrapped in the shared Toolbox shell. Browser `File` handles and small metadata records remain on the main thread; one fresh module worker performs each inspection or streaming hash and is terminated on completion, cancellation, timeout, replacement or unmount.
+
+The worker reads at most 1 MiB from each end for signature, entropy, text and string heuristics. SHA-256 and SHA-512 are updated together in 1 MiB chunks, so hashing does not buffer the complete file. The hex view independently reads one 512-byte window. `file/signatures.ts` contains project-owned evidence heuristics; `file-type` provides broader signature hints; `@noble/hashes` provides incremental hashes.
+
+`file/manifest.ts` sorts by path and emits JSON or spreadsheet-neutralised CSV. Duplicate groups start as same-size candidates and become stronger same-hash candidates after explicit hashing; no deletion or mutation follows. Relative worker and asset URLs keep the build relocatable below a nested portal path.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,7 @@
+# Privacy and security
+
+Selected files remain browser `File` objects and are never uploaded. There is no telemetry, analytics, account, persistence or runtime network path. A selection is limited to 500 entries. Inspection reads bounded samples, the hex view reads one window, and hashing streams the selected file only after an explicit action.
+
+Worker jobs are isolated from the UI thread and are terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
+
+Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence but the app does not delete, rename, split, join or otherwise mutate files.

public/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="File Tools"><path fill="#5b4ec4" d="M11 4h30l12 12v44H11z"/><path fill="#fff" opacity=".28" d="M41 4v14h12"/><text x="32" y="43" fill="#fff" font-family="system-ui,sans-serif" font-size="18" font-weight="800" text-anchor="middle">FI</text></svg>

public/manifest.webmanifest

@@ -0,0 +1,18 @@
+{
+  "name": "File Tools",
+  "short_name": "File",
+  "description": "Identify, inspect and inventory local files in the browser.",
+  "start_url": "./",
+  "scope": "./",
+  "display": "standalone",
+  "background_color": "#f6f7fb",
+  "theme_color": "#29255f",
+  "icons": [
+    {
+      "src": "./favicon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any maskable"
+    }
+  ]
+}

public/sw.js

@@ -0,0 +1,54 @@
+const CACHE_PREFIX = "file-tools-shell-";
+const CACHE_NAME = CACHE_PREFIX + "0.1.0";
+const CORE = ["./", "./manifest.webmanifest", "./favicon.svg"];
+self.addEventListener("install", (event) => {
+  event.waitUntil(
+    caches.open(CACHE_NAME).then(async (cache) => {
+      await cache.addAll(CORE);
+      const html = await (await fetch("./")).text();
+      const assets = [...html.matchAll(/(?:src|href)="(\.\/assets\/[^"]+)"/g)]
+        .map((match) => match[1])
+        .filter(Boolean);
+      await cache.addAll(assets);
+    }),
+  );
+  self.skipWaiting();
+});
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches
+      .keys()
+      .then((keys) =>
+        Promise.all(
+          keys
+            .filter((key) => key.startsWith(CACHE_PREFIX) && key !== CACHE_NAME)
+            .map((key) => caches.delete(key)),
+        ),
+      )
+      .then(() => self.clients.claim()),
+  );
+});
+self.addEventListener("fetch", (event) => {
+  if (event.request.method !== "GET") return;
+  const url = new URL(event.request.url);
+  if (
+    url.origin !== self.location.origin ||
+    !url.pathname.startsWith(new URL(self.registration.scope).pathname)
+  )
+    return;
+  event.respondWith(
+    caches.match(event.request).then(
+      (cached) =>
+        cached ??
+        fetch(event.request).then((response) => {
+          if (response.ok) {
+            const copy = response.clone();
+            void caches
+              .open(CACHE_NAME)
+              .then((cache) => cache.put(event.request, copy));
+          }
+          return response;
+        }),
+    ),
+  );
+});

public/toolbox-app.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://git.add-ideas.de/lotobo/toolbox-sdk/raw/branch/main/schemas/toolbox-app.v1.schema.json",
+  "schemaVersion": 1,
+  "id": "de.add-ideas.file-tools",
+  "name": "File Tools",
+  "version": "0.1.0",
+  "description": "Identify, inspect and inventory local files in the browser.",
+  "entry": "./",
+  "icon": "./favicon.svg",
+  "categories": ["files", "developer", "productivity"],
+  "tags": ["file", "hex", "checksum", "manifest", "duplicate"],
+  "integration": {
+    "contextVersion": 1,
+    "launchModes": ["navigate", "new-tab"],
+    "embedding": "unsupported"
+  },
+  "requirements": {
+    "secureContext": false,
+    "workers": true,
+    "indexedDb": false,
+    "crossOriginIsolated": false,
+    "topLevelContext": false
+  },
+  "privacy": {
+    "processing": "local",
+    "fileUploads": true,
+    "telemetry": false,
+    "label": "Inputs stay in this browser; nothing is uploaded."
+  },
+  "source": {
+    "repository": "https://git.add-ideas.de/lotobo/file-tools",
+    "license": "GPL-3.0-or-later"
+  },
+  "actions": [
+    {
+      "id": "source",
+      "label": "Source",
+      "url": "https://git.add-ideas.de/lotobo/file-tools"
+    }
+  ]
+}

scripts/generate-toolbox-manifest.mjs

@@ -0,0 +1,33 @@
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { format } from "prettier";
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const sourcePath = path.join(root, "src/toolbox/manifest.source.json");
+const outputPath = path.join(root, "public/toolbox-app.json");
+const source = JSON.parse(await readFile(sourcePath, "utf8"));
+const pkg = JSON.parse(await readFile(path.join(root, "package.json"), "utf8"));
+const versionSource = await readFile(path.join(root, "src/version.ts"), "utf8");
+const appVersion = /^export const APP_VERSION = "([^"]+)";$/mu.exec(
+  versionSource,
+)?.[1];
+const repository = "https://git.add-ideas.de/lotobo/" + pkg.name;
+if (source.version !== pkg.version || appVersion !== pkg.version)
+  throw new Error("Version identity drift");
+if (
+  source.id !== "de.add-ideas." + pkg.name ||
+  source.source?.repository !== repository ||
+  source.source?.license !== "GPL-3.0-or-later"
+)
+  throw new Error("Manifest source identity is invalid");
+const serialized = await format(JSON.stringify(source), {
+  filepath: outputPath,
+});
+if (process.argv.includes("--check")) {
+  if ((await readFile(outputPath, "utf8").catch(() => "")) !== serialized)
+    throw new Error("public/toolbox-app.json is stale");
+  console.log("Toolbox manifest is synchronized");
+} else {
+  await writeFile(outputPath, serialized);
+  console.log("Generated public/toolbox-app.json");
+}

scripts/package-release.mjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import {
+  access,
+  chmod,
+  copyFile,
+  cp,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  utimes,
+  writeFile,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+const execute = promisify(execFile);
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const pkg = JSON.parse(await readFile(path.join(root, "package.json"), "utf8"));
+const argument = (name, fallback) => {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : fallback;
+};
+const output = path.resolve(
+  root,
+  argument("--output", "release/" + pkg.name + "-" + pkg.version + ".zip"),
+);
+const checksumOutput = output + ".sha256";
+const force = process.argv.includes("--force");
+if (
+  path.extname(output).toLowerCase() !== ".zip" ||
+  output === root ||
+  output === path.parse(output).root
+)
+  throw new Error("Unsafe release target");
+const exists = (file) =>
+  access(file).then(
+    () => true,
+    () => false,
+  );
+if (!force && ((await exists(output)) || (await exists(checksumOutput))))
+  throw new Error("Release output exists");
+const input = path.join(root, "dist");
+for (const name of [
+  "index.html",
+  "manifest.webmanifest",
+  "sw.js",
+  "toolbox-app.json",
+  "favicon.svg",
+  "README.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  "LICENSE",
+  "SECURITY.md",
+  "SOURCE.md",
+  "THIRD_PARTY_NOTICES.md",
+  "LICENSES/README.md",
+  "LICENSES/npm-runtime-licenses.txt",
+  "docs/ACCESSIBILITY.md",
+  "docs/ARCHITECTURE.md",
+  "docs/PRIVACY-SECURITY.md",
+]) {
+  const details = await lstat(path.join(input, name)).catch(() => null);
+  if (!details?.isFile() || details.isSymbolicLink())
+    throw new Error("Missing release file: " + name);
+}
+const manifest = JSON.parse(
+  await readFile(path.join(input, "toolbox-app.json"), "utf8"),
+);
+const repository = "https://git.add-ideas.de/lotobo/" + pkg.name;
+if (
+  manifest.id !== "de.add-ideas." + pkg.name ||
+  manifest.version !== pkg.version ||
+  manifest.entry !== "./" ||
+  manifest.icon !== "./favicon.svg" ||
+  manifest.source?.repository !== repository
+)
+  throw new Error("Packaged manifest identity is invalid");
+if (
+  /\b(?:src|href)=["']\//iu.test(
+    await readFile(path.join(input, "index.html"), "utf8"),
+  )
+)
+  throw new Error("Root-absolute asset reference");
+async function collect(directory, prefix = "") {
+  const files = [];
+  for (const entry of (await readdir(directory, { withFileTypes: true })).sort(
+    (a, b) => a.name.localeCompare(b.name),
+  )) {
+    const absolute = path.join(directory, entry.name);
+    const relative = prefix ? prefix + "/" + entry.name : entry.name;
+    if (entry.isSymbolicLink())
+      throw new Error("Symlink in release: " + relative);
+    if (entry.isDirectory()) files.push(...(await collect(absolute, relative)));
+    else if (entry.isFile()) files.push({ absolute, relative });
+    else throw new Error("Unsupported release entry: " + relative);
+  }
+  return files;
+}
+const sourceFiles = await collect(input);
+for (const file of sourceFiles)
+  if (
+    file.relative.endsWith(".map") ||
+    /(?:^|\/)(?:\.env(?:\.|$)|id_rsa|id_ed25519|.*\.pem$|.*\.key$)/iu.test(
+      file.relative,
+    ) ||
+    file.relative.split("/").includes("..")
+  )
+    throw new Error("Forbidden release entry: " + file.relative);
+await mkdir(path.dirname(output), { recursive: true });
+const stagingRoot = await mkdtemp(
+  path.join(os.tmpdir(), pkg.name + "-release-"),
+);
+const publicationRoot = await mkdtemp(
+  path.join(path.dirname(output), "." + pkg.name + "-publish-"),
+);
+const stagedTree = path.join(stagingRoot, "tree");
+const stagedArchive = path.join(stagingRoot, path.basename(output));
+try {
+  await cp(input, stagedTree, { recursive: true });
+  const timestamp = new Date("1980-01-01T00:00:00.000Z");
+  for (const file of await collect(stagedTree)) {
+    await chmod(file.absolute, 0o644);
+    await utimes(file.absolute, timestamp, timestamp);
+  }
+  await execute(
+    "zip",
+    [
+      "-X",
+      "-q",
+      "-9",
+      stagedArchive,
+      ...sourceFiles.map((file) => file.relative),
+    ],
+    {
+      cwd: stagedTree,
+      env: { ...process.env, TZ: "UTC" },
+      maxBuffer: 1024 * 1024,
+    },
+  );
+  const archive = await readFile(stagedArchive);
+  const digest = createHash("sha256").update(archive).digest("hex");
+  const stagedChecksum = stagedArchive + ".sha256";
+  await writeFile(stagedChecksum, digest + "  " + path.basename(output) + "\n");
+  const publicationArchive = path.join(publicationRoot, path.basename(output));
+  const publicationChecksum = publicationArchive + ".sha256";
+  await copyFile(stagedArchive, publicationArchive);
+  await copyFile(stagedChecksum, publicationChecksum);
+  if (force) {
+    await rm(output, { force: true });
+    await rm(checksumOutput, { force: true });
+  }
+  await rename(publicationArchive, output);
+  await rename(publicationChecksum, checksumOutput);
+  console.log("Created " + path.relative(root, output) + "\nSHA-256 " + digest);
+} finally {
+  await rm(stagingRoot, { recursive: true, force: true });
+  await rm(publicationRoot, { recursive: true, force: true });
+}

scripts/prepare-release-files.mjs

@@ -0,0 +1,70 @@
+import { cp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const destination = path.join(root, "public");
+for (const name of [
+  "LICENSE",
+  "README.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  "SECURITY.md",
+  "SOURCE.md",
+  "THIRD_PARTY_NOTICES.md",
+]) {
+  await readFile(path.join(root, name));
+  await cp(path.join(root, name), path.join(destination, name));
+}
+for (const directory of ["LICENSES", "docs"]) {
+  const output = path.join(destination, directory);
+  await rm(output, { recursive: true, force: true });
+  await cp(path.join(root, directory), output, { recursive: true });
+}
+const lock = JSON.parse(
+  await readFile(path.join(root, "package-lock.json"), "utf8"),
+);
+const sections = [];
+for (const [location, locked] of Object.entries(lock.packages ?? {}).sort(
+  ([a], [b]) => a.localeCompare(b),
+)) {
+  if (!location.includes("node_modules/") || locked.dev === true) continue;
+  const packageDirectory = path.join(root, location);
+  const details = JSON.parse(
+    await readFile(path.join(packageDirectory, "package.json"), "utf8"),
+  );
+  const candidates = (await readdir(packageDirectory))
+    .filter((name) => /^(?:licen[cs]e|copying|notice)(?:\.|$)/iu.test(name))
+    .sort();
+  const texts = [];
+  for (const candidate of candidates) {
+    try {
+      texts.push(
+        "--- " +
+          candidate +
+          " ---\n" +
+          (await readFile(path.join(packageDirectory, candidate), "utf8")),
+      );
+    } catch {
+      /* directory */
+    }
+  }
+  sections.push(
+    "=".repeat(78) +
+      "\n" +
+      details.name +
+      "@" +
+      details.version +
+      "\nDeclared licence: " +
+      (details.license ?? locked.license ?? "See upstream") +
+      "\n" +
+      "=".repeat(78) +
+      "\n" +
+      (texts.join("\n\n") || "See upstream package metadata."),
+  );
+}
+await mkdir(path.join(destination, "LICENSES"), { recursive: true });
+await writeFile(
+  path.join(destination, "LICENSES/npm-runtime-licenses.txt"),
+  sections.join("\n\n").trimEnd() + "\n",
+);
+console.log("Prepared release documentation");

scripts/serve-test.mjs

@@ -0,0 +1,71 @@
+import { createServer } from "node:http";
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+  "dist",
+);
+const prefix = "/deep/nested/file/";
+const types = new Map([
+  [".css", "text/css; charset=utf-8"],
+  [".html", "text/html; charset=utf-8"],
+  [".js", "text/javascript; charset=utf-8"],
+  [".json", "application/json; charset=utf-8"],
+  [".webmanifest", "application/manifest+json; charset=utf-8"],
+  [".svg", "image/svg+xml"],
+  [".md", "text/markdown; charset=utf-8"],
+  [".txt", "text/plain; charset=utf-8"],
+  [".wasm", "application/wasm"],
+  [".png", "image/png"],
+  [".jpg", "image/jpeg"],
+  [".webp", "image/webp"],
+]);
+const headers = {
+  "Content-Security-Policy":
+    "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "Permissions-Policy":
+    "camera=(), microphone=(), geolocation=(), usb=(), payment=()",
+  "Referrer-Policy": "no-referrer",
+  "X-Content-Type-Options": "nosniff",
+};
+const server = createServer(async (request, response) => {
+  try {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    const relative = decodeURIComponent(url.pathname).startsWith(prefix)
+      ? decodeURIComponent(url.pathname).slice(prefix.length)
+      : decodeURIComponent(url.pathname).replace(/^\/+/, "");
+    const normalized = path.posix.normalize(relative || "index.html");
+    if (
+      normalized === ".." ||
+      normalized.startsWith("../") ||
+      path.isAbsolute(normalized)
+    ) {
+      response.writeHead(400).end("Bad request");
+      return;
+    }
+    let file = path.join(root, normalized);
+    if ((await stat(file).catch(() => null))?.isDirectory())
+      file = path.join(file, "index.html");
+    const content = await readFile(file);
+    const immutable = /^assets\/[^/]+-[A-Za-z0-9_-]{8,}\.[^.]+$/u.test(
+      normalized,
+    );
+    response.writeHead(200, {
+      "Content-Type":
+        types.get(path.extname(file)) ?? "application/octet-stream",
+      "Cache-Control": immutable
+        ? "public, max-age=31536000, immutable"
+        : "no-cache",
+      ...headers,
+    });
+    response.end(content);
+  } catch {
+    response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+    response.end("Not found");
+  }
+});
+server.listen(4173, "127.0.0.1", () => console.log("Test server ready"));

src/App.tsx

@@ -0,0 +1,35 @@
+import { lazy, Suspense, useState } from "react";
+import { AppShell } from "@add-ideas/toolbox-shell-react";
+import "@add-ideas/toolbox-shell-react/styles.css";
+import "./styles.css";
+import { ErrorBoundary } from "./components/ErrorBoundary";
+import { HelpDialog } from "./components/HelpDialog";
+import { manifest } from "./toolbox/manifest";
+
+const Workbench = lazy(async () => ({
+  default: (await import("./components/Workbench")).Workbench,
+}));
+
+export function App() {
+  const [helpOpen, setHelpOpen] = useState(false);
+  return (
+    <ErrorBoundary>
+      <AppShell
+        app={manifest}
+        manifestUrl="./toolbox-app.json"
+        helpAction={{ onClick: () => setHelpOpen(true) }}
+      >
+        <Suspense
+          fallback={
+            <p className="loading" role="status">
+              Preparing File Tools…
+            </p>
+          }
+        >
+          <Workbench />
+        </Suspense>
+      </AppShell>
+      <HelpDialog open={helpOpen} onClose={() => setHelpOpen(false)} />
+    </ErrorBoundary>
+  );
+}

src/components/ErrorBoundary.tsx

@@ -0,0 +1,27 @@
+import { Component, type ErrorInfo, type ReactNode } from "react";
+
+export class ErrorBoundary extends Component<
+  { children: ReactNode },
+  { error?: Error }
+> {
+  state: { error?: Error } = {};
+  static getDerivedStateFromError(error: Error) {
+    return { error };
+  }
+  componentDidCatch(error: Error, info: ErrorInfo) {
+    console.error("Application failure", error, info);
+  }
+  render() {
+    if (this.state.error)
+      return (
+        <main className="fatal">
+          <h1>File Tools could not continue</h1>
+          <p>{this.state.error.message}</p>
+          <button type="button" onClick={() => location.reload()}>
+            Reload
+          </button>
+        </main>
+      );
+    return this.props.children;
+  }
+}

src/components/HelpDialog.tsx

@@ -0,0 +1,41 @@
+import { useEffect, useRef } from "react";
+
+export function HelpDialog({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  const dialog = useRef<HTMLDialogElement>(null);
+  useEffect(() => {
+    const node = dialog.current;
+    if (!node) return;
+    if (open && !node.open) node.showModal();
+    if (!open && node.open) node.close();
+  }, [open]);
+  return (
+    <dialog
+      ref={dialog}
+      className="help-dialog"
+      onClose={onClose}
+      onCancel={onClose}
+      aria-labelledby="help-title"
+    >
+      <div className="dialog-heading">
+        <div>
+          <p className="eyebrow">Local-first help</p>
+          <h2 id="help-title">About File Tools</h2>
+        </div>
+        <button type="button" onClick={onClose} aria-label="Close help">
+          ×
+        </button>
+      </div>
+      <p>Identify, inspect and inventory local files in the browser.</p>
+      <p>
+        All processing is performed in this browser. Imported data is treated as
+        untrusted and bounded before parsing.
+      </p>
+    </dialog>
+  );
+}

src/components/Workbench.tsx

@@ -0,0 +1,574 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { triggerBlobDownload } from "@add-ideas/toolbox-helpers";
+import { manifestCsv, manifestJson, type FileRecord } from "../file/manifest";
+import type {
+  FileInspection,
+  WorkerRequest,
+  WorkerResponse,
+} from "../file/protocol";
+
+interface LocalRecord extends FileRecord {
+  id: string;
+  file: File;
+}
+type JobResult =
+  { inspection: FileInspection } | { sha256: string; sha512: string };
+interface WorkerJob {
+  promise: Promise<JobResult>;
+  cancel(): void;
+}
+let nextRecordId = 0;
+
+function runWorker(
+  file: File,
+  task: WorkerRequest["task"],
+  onProgress?: (loaded: number, total: number) => void,
+  timeout = 0,
+): WorkerJob {
+  const worker = new Worker(
+    new URL("../workers/inspect.worker.ts", import.meta.url),
+    { type: "module" },
+  );
+  const id = 1;
+  let settled = false;
+  let rejectPromise: ((reason?: unknown) => void) | undefined;
+  let timer: number | undefined;
+  const stop = () => {
+    if (timer !== undefined) window.clearTimeout(timer);
+    worker.terminate();
+  };
+  const promise = new Promise<JobResult>((resolve, reject) => {
+    rejectPromise = reject;
+    timer = timeout
+      ? window.setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          stop();
+          reject(
+            new Error(
+              `Inspection exceeded its ${Math.round(timeout / 1_000)}-second safety limit.`,
+            ),
+          );
+        }, timeout)
+      : undefined;
+    worker.addEventListener(
+      "message",
+      (event: MessageEvent<WorkerResponse>) => {
+        const response = event.data;
+        if (response.id !== id || settled) return;
+        if (response.type === "progress") {
+          onProgress?.(response.loaded, response.total);
+          return;
+        }
+        settled = true;
+        stop();
+        if (response.type === "error") reject(new Error(response.message));
+        else if (response.type === "inspection")
+          resolve({ inspection: response.result });
+        else if (response.type === "hash")
+          resolve({ sha256: response.sha256, sha512: response.sha512 });
+      },
+    );
+    worker.addEventListener("error", () => {
+      if (settled) return;
+      settled = true;
+      stop();
+      reject(new Error("The isolated file worker failed."));
+    });
+    worker.postMessage({ id, task, file } satisfies WorkerRequest);
+  });
+  return {
+    promise,
+    cancel() {
+      if (settled) return;
+      settled = true;
+      stop();
+      rejectPromise?.(new DOMException("Operation cancelled.", "AbortError"));
+    },
+  };
+}
+
+function formatSize(value: number): string {
+  if (value < 1024) return `${value} B`;
+  if (value < 1024 ** 2) return `${(value / 1024).toFixed(1)} KiB`;
+  if (value < 1024 ** 3) return `${(value / 1024 ** 2).toFixed(1)} MiB`;
+  return `${(value / 1024 ** 3).toFixed(2)} GiB`;
+}
+
+function HexView({ file }: { file: File }) {
+  const [offset, setOffset] = useState(0);
+  const [bytes, setBytes] = useState<Uint8Array>(new Uint8Array());
+  useEffect(() => {
+    let current = true;
+    void file
+      .slice(offset, Math.min(file.size, offset + 512))
+      .arrayBuffer()
+      .then((value) => {
+        if (current) setBytes(new Uint8Array(value));
+      });
+    return () => {
+      current = false;
+    };
+  }, [file, offset]);
+  const rows = useMemo(
+    () =>
+      Array.from({ length: Math.ceil(bytes.length / 16) }, (_, index) => {
+        const row = bytes.slice(index * 16, index * 16 + 16);
+        return {
+          offset: offset + index * 16,
+          hex: [...row]
+            .map((byte) => byte.toString(16).padStart(2, "0"))
+            .join(" ")
+            .toUpperCase(),
+          ascii: [...row]
+            .map((byte) =>
+              byte >= 32 && byte <= 126 ? String.fromCharCode(byte) : "·",
+            )
+            .join(""),
+        };
+      }),
+    [bytes, offset],
+  );
+  const jump = (value: number) =>
+    setOffset(
+      Math.max(
+        0,
+        Math.min(Math.max(0, file.size - 1), Math.floor(value / 16) * 16),
+      ),
+    );
+  return (
+    <div className="hex-view">
+      <div className="hex-controls">
+        <button
+          type="button"
+          onClick={() => jump(offset - 512)}
+          disabled={offset === 0}
+        >
+          Previous
+        </button>
+        <label className="field">
+          <span>Jump to decimal offset</span>
+          <input
+            type="number"
+            min="0"
+            max={Math.max(0, file.size - 1)}
+            value={offset}
+            onChange={(event) => jump(event.target.valueAsNumber || 0)}
+          />
+        </label>
+        <button
+          type="button"
+          onClick={() => jump(offset + 512)}
+          disabled={offset + bytes.length >= file.size}
+        >
+          Next
+        </button>
+      </div>
+      <div
+        className="hex-table"
+        role="table"
+        aria-label="Bounded hexadecimal view"
+      >
+        {rows.map((row) => (
+          <div className="hex-row" role="row" key={row.offset}>
+            <span>
+              {row.offset.toString(16).padStart(8, "0").toUpperCase()}
+            </span>
+            <code>{row.hex.padEnd(47, " ")}</code>
+            <code>{row.ascii}</code>
+          </div>
+        ))}
+      </div>
+      <p className="muted">
+        Only this 512-byte window is read. Navigate to inspect another range.
+      </p>
+    </div>
+  );
+}
+
+export function Workbench() {
+  const [records, setRecords] = useState<LocalRecord[]>([]);
+  const [selectedId, setSelectedId] = useState("");
+  const [busy, setBusy] = useState("");
+  const [progress, setProgress] = useState(0);
+  const [error, setError] = useState("");
+  const activeJob = useRef<WorkerJob | undefined>(undefined);
+  const selected = records.find((record) => record.id === selectedId);
+  useEffect(() => () => activeJob.current?.cancel(), []);
+
+  const addFiles = (files: FileList | null) => {
+    if (!files) return;
+    const added = [...files].slice(0, 500).map((file): LocalRecord => ({
+      id: `file-${++nextRecordId}`,
+      file,
+      name: file.name,
+      path: file.webkitRelativePath || file.name,
+      size: file.size,
+      type: file.type,
+      lastModified: file.lastModified,
+    }));
+    setRecords(added);
+    setSelectedId(added[0]?.id ?? "");
+    setError(
+      files.length > 500 ? "Only the first 500 selected files were added." : "",
+    );
+    if (added[0]) void inspectRecord(added[0], added);
+  };
+
+  const update = (
+    id: string,
+    changes: Partial<LocalRecord>,
+    base?: LocalRecord[],
+  ) =>
+    setRecords((current) =>
+      (base ?? current).map((record) =>
+        record.id === id ? { ...record, ...changes } : record,
+      ),
+    );
+  const inspectRecord = async (record: LocalRecord, base?: LocalRecord[]) => {
+    activeJob.current?.cancel();
+    setBusy(`Inspecting ${record.name}`);
+    setError("");
+    const job = runWorker(record.file, "inspect", undefined, 15_000);
+    activeJob.current = job;
+    try {
+      const result = await job.promise;
+      if ("inspection" in result)
+        update(record.id, { inspection: result.inspection }, base);
+    } catch (reason) {
+      if (!(reason instanceof DOMException && reason.name === "AbortError"))
+        setError(
+          reason instanceof Error ? reason.message : "Inspection failed.",
+        );
+    } finally {
+      if (activeJob.current === job) {
+        activeJob.current = undefined;
+        setBusy("");
+      }
+    }
+  };
+  const hashRecord = async (
+    record: LocalRecord,
+  ): Promise<LocalRecord | undefined> => {
+    activeJob.current?.cancel();
+    setBusy(`Hashing ${record.name}`);
+    setProgress(0);
+    const job = runWorker(record.file, "hash", (loaded, total) =>
+      setProgress(total ? loaded / total : 1),
+    );
+    activeJob.current = job;
+    try {
+      const result = await job.promise;
+      if ("sha256" in result) {
+        const next = {
+          ...record,
+          sha256: result.sha256,
+          sha512: result.sha512,
+        };
+        update(record.id, next);
+        return next;
+      }
+    } catch (reason) {
+      if (!(reason instanceof DOMException && reason.name === "AbortError"))
+        setError(reason instanceof Error ? reason.message : "Hashing failed.");
+    } finally {
+      if (activeJob.current === job) {
+        activeJob.current = undefined;
+        setBusy("");
+      }
+    }
+    return undefined;
+  };
+  const hashAll = async () => {
+    setError("");
+    for (const record of records) {
+      const latest = await hashRecord(record);
+      if (!latest) break;
+    }
+  };
+  const cancel = () => {
+    activeJob.current?.cancel();
+    activeJob.current = undefined;
+    setBusy("");
+    setError("Operation cancelled; the last completed result was kept.");
+  };
+  const duplicates = useMemo(() => {
+    const groups = new Map<string, LocalRecord[]>();
+    for (const record of records) {
+      const key = record.sha256
+        ? `sha256:${record.sha256}`
+        : `size:${record.size}`;
+      const group = groups.get(key) ?? [];
+      group.push(record);
+      groups.set(key, group);
+    }
+    return [...groups.entries()].filter(([, group]) => group.length > 1);
+  }, [records]);
+  const exportManifest = (format: "json" | "csv") => {
+    const text =
+      format === "json" ? manifestJson(records) : manifestCsv(records);
+    triggerBlobDownload(
+      new Blob([text], {
+        type: format === "json" ? "application/json" : "text/csv",
+      }),
+      `file-manifest.${format}`,
+    );
+  };
+
+  return (
+    <main className="workbench">
+      <header className="hero">
+        <div>
+          <p className="eyebrow">Bounded local inspection</p>
+          <h1>File Tools</h1>
+          <p>
+            Identify, inspect, hash, compare, and inventory files without
+            uploading them or executing their contents.
+          </p>
+        </div>
+        <span className="privacy-pill">Browser-local</span>
+      </header>
+      <section className="panel workspace" aria-labelledby="open-heading">
+        <div className="panel-heading">
+          <div>
+            <p className="eyebrow">Open</p>
+            <h2 id="open-heading">Files or a directory</h2>
+          </div>
+          <div className="actions">
+            <label className="button file-button">
+              Choose files
+              <input
+                type="file"
+                multiple
+                onChange={(event) => addFiles(event.target.files)}
+              />
+            </label>
+            <label className="button file-button">
+              Choose directory
+              <input
+                type="file"
+                multiple
+                ref={(node) => node?.setAttribute("webkitdirectory", "")}
+                onChange={(event) => addFiles(event.target.files)}
+              />
+            </label>
+          </div>
+        </div>
+        <p className="muted">
+          Up to 500 entries per selection. Inspection reads bounded head/tail
+          samples; hashes stream in 1 MiB chunks.
+        </p>
+        {error && (
+          <p className="error" role="alert">
+            {error}
+          </p>
+        )}
+        {busy && (
+          <div className="progress">
+            <span>{busy}</span>
+            <progress value={progress || undefined} max="1" />
+            <button type="button" onClick={cancel}>
+              Cancel
+            </button>
+          </div>
+        )}
+      </section>
+      {records.length > 0 && (
+        <div className="file-layout">
+          <section className="panel file-list" aria-label="Selected files">
+            <div className="panel-heading">
+              <div>
+                <p className="eyebrow">Selection</p>
+                <h2>
+                  {records.length} file{records.length === 1 ? "" : "s"}
+                </h2>
+              </div>
+            </div>
+            {records.map((record) => (
+              <button
+                type="button"
+                className="file-row"
+                aria-current={record.id === selectedId}
+                onClick={() => setSelectedId(record.id)}
+                key={record.id}
+              >
+                <span>
+                  <strong>{record.path}</strong>
+                  <small>
+                    {(record.inspection?.detected?.mime ?? record.type) ||
+                      "Unknown type"}
+                  </small>
+                </span>
+                <span>{formatSize(record.size)}</span>
+              </button>
+            ))}
+          </section>
+          {selected && (
+            <section
+              className="panel workspace"
+              aria-labelledby="inspection-heading"
+            >
+              <div className="panel-heading">
+                <div>
+                  <p className="eyebrow">Last successful result</p>
+                  <h2 id="inspection-heading">{selected.name}</h2>
+                </div>
+                <div className="actions">
+                  <button
+                    type="button"
+                    onClick={() => void inspectRecord(selected)}
+                  >
+                    Inspect
+                  </button>
+                  <button
+                    type="button"
+                    onClick={() => void hashRecord(selected)}
+                  >
+                    Hash
+                  </button>
+                </div>
+              </div>
+              <dl className="facts">
+                <div>
+                  <dt>Size</dt>
+                  <dd>{selected.size.toLocaleString()} bytes</dd>
+                </div>
+                <div>
+                  <dt>Claimed MIME</dt>
+                  <dd>{selected.type || "—"}</dd>
+                </div>
+                <div>
+                  <dt>Detected signature</dt>
+                  <dd>
+                    {selected.inspection?.detected
+                      ? `${selected.inspection.detected.mime} (.${selected.inspection.detected.extension})`
+                      : "Not yet / unknown"}
+                  </dd>
+                </div>
+                <div>
+                  <dt>Sample entropy</dt>
+                  <dd>
+                    {selected.inspection
+                      ? `${selected.inspection.entropy.toFixed(3)} bits/byte over ${formatSize(selected.inspection.sampleBytes)}`
+                      : "—"}
+                  </dd>
+                </div>
+                <div>
+                  <dt>SHA-256</dt>
+                  <dd>{selected.sha256 ?? "Not calculated"}</dd>
+                </div>
+                <div>
+                  <dt>SHA-512</dt>
+                  <dd>{selected.sha512 ?? "Not calculated"}</dd>
+                </div>
+              </dl>
+              {selected.inspection?.findings.map((finding) => (
+                <p className="warning" key={finding}>
+                  {finding}
+                </p>
+              ))}
+              {selected.inspection?.evidence.length ? (
+                <details>
+                  <summary>Signature evidence</summary>
+                  <ul>
+                    {selected.inspection.evidence.map((item) => (
+                      <li key={`${item.offset}-${item.description}`}>
+                        Offset {item.offset.toLocaleString()}:{" "}
+                        {item.description} ({item.signature})
+                      </li>
+                    ))}
+                  </ul>
+                </details>
+              ) : null}
+              <details open>
+                <summary>Hex and ASCII window</summary>
+                <HexView file={selected.file} />
+              </details>
+              {selected.inspection?.textPreview !== undefined && (
+                <details>
+                  <summary>Bounded UTF-8 preview</summary>
+                  <pre>{selected.inspection.textPreview}</pre>
+                </details>
+              )}
+              {selected.inspection?.strings.length ? (
+                <details>
+                  <summary>
+                    Extracted ASCII / UTF-16LE strings (
+                    {selected.inspection.strings.length})
+                  </summary>
+                  <ul className="strings">
+                    {selected.inspection.strings.map((value, index) => (
+                      <li key={`${index}-${value}`}>{value}</li>
+                    ))}
+                  </ul>
+                </details>
+              ) : null}
+            </section>
+          )}
+        </div>
+      )}
+      {records.length > 0 && (
+        <div className="grid">
+          <section
+            className="panel workspace"
+            aria-labelledby="duplicates-heading"
+          >
+            <div>
+              <p className="eyebrow">Duplicates</p>
+              <h2 id="duplicates-heading">Candidate groups</h2>
+            </div>
+            <p className="muted">
+              Same-size groups are provisional; groups with SHA-256 are
+              byte-identity candidates.
+            </p>
+            {duplicates.length ? (
+              duplicates.map(([key, group]) => (
+                <div className="duplicate" key={key}>
+                  <strong>
+                    {key.startsWith("sha256:")
+                      ? "Same SHA-256"
+                      : `Same size (${formatSize(group[0]!.size)})`}
+                  </strong>
+                  <span>{group.map((record) => record.path).join(" · ")}</span>
+                </div>
+              ))
+            ) : (
+              <p>No duplicate candidates.</p>
+            )}
+            <button type="button" onClick={() => void hashAll()}>
+              Stream hashes for all files
+            </button>
+          </section>
+          <section
+            className="panel workspace"
+            aria-labelledby="manifest-heading"
+          >
+            <div>
+              <p className="eyebrow">Manifest</p>
+              <h2 id="manifest-heading">Deterministic inventory</h2>
+            </div>
+            <p className="muted">
+              Sorted by path. CSV neutralises spreadsheet-formula prefixes.
+            </p>
+            <div className="actions">
+              <button type="button" onClick={() => exportManifest("json")}>
+                Download JSON
+              </button>
+              <button type="button" onClick={() => exportManifest("csv")}>
+                Download CSV
+              </button>
+            </div>
+          </section>
+        </div>
+      )}
+      <section className="panel workspace">
+        <p className="notice">
+          Detection is a signature hint, not format validation. Entropy,
+          embedded signatures, and trailing bytes are heuristics and do not
+          establish encryption, malware, steganography, or intent. File
+          mutation, split/join, and batch rename are deferred.
+        </p>
+      </section>
+    </main>
+  );
+}

src/file/manifest.ts

@@ -0,0 +1,74 @@
+import type { FileInspection } from "./protocol";
+
+export interface FileRecord {
+  name: string;
+  path: string;
+  size: number;
+  type: string;
+  lastModified: number;
+  inspection?: FileInspection;
+  sha256?: string;
+  sha512?: string;
+}
+
+export function manifestJson(records: FileRecord[]): string {
+  return JSON.stringify(
+    {
+      schemaVersion: 1,
+      generatedBy: "add-ideas File Tools 0.1.0",
+      files: [...records]
+        .sort((left, right) => left.path.localeCompare(right.path))
+        .map((record) => ({
+          path: record.path,
+          size: record.size,
+          lastModified: new Date(record.lastModified).toISOString(),
+          claimedMime: record.type || null,
+          detectedMime: record.inspection?.detected?.mime ?? null,
+          sha256: record.sha256 ?? null,
+          sha512: record.sha512 ?? null,
+          findings: record.inspection?.findings ?? [],
+        })),
+    },
+    null,
+    2,
+  );
+}
+
+function csv(value: unknown): string {
+  const text = String(value ?? "");
+  const safe = /^[=+\-@\t\r]/u.test(text) ? `'${text}` : text;
+  return `"${safe.replaceAll('"', '""')}"`;
+}
+
+export function manifestCsv(records: FileRecord[]): string {
+  const lines = [
+    [
+      "path",
+      "size",
+      "lastModified",
+      "claimedMime",
+      "detectedMime",
+      "sha256",
+      "sha512",
+    ]
+      .map(csv)
+      .join(","),
+  ];
+  for (const record of [...records].sort((left, right) =>
+    left.path.localeCompare(right.path),
+  ))
+    lines.push(
+      [
+        record.path,
+        record.size,
+        new Date(record.lastModified).toISOString(),
+        record.type,
+        record.inspection?.detected?.mime,
+        record.sha256,
+        record.sha512,
+      ]
+        .map(csv)
+        .join(","),
+    );
+  return lines.join("\r\n") + "\r\n";
+}

src/file/protocol.ts

@@ -0,0 +1,28 @@
+export interface DetectionEvidence {
+  offset: number;
+  signature: string;
+  description: string;
+}
+export interface FileInspection {
+  detected?: {
+    extension: string;
+    mime: string;
+    confidence: "signature" | "heuristic";
+  };
+  evidence: DetectionEvidence[];
+  entropy: number;
+  sampleBytes: number;
+  textPreview?: string;
+  strings: string[];
+  findings: string[];
+}
+
+export type WorkerRequest =
+  | { id: number; task: "inspect"; file: File }
+  | { id: number; task: "hash"; file: File };
+
+export type WorkerResponse =
+  | { id: number; type: "inspection"; result: FileInspection }
+  | { id: number; type: "progress"; loaded: number; total: number }
+  | { id: number; type: "hash"; sha256: string; sha512: string }
+  | { id: number; type: "error"; message: string };

src/file/signatures.ts

@@ -0,0 +1,229 @@
+import type { DetectionEvidence } from "./protocol";
+
+interface Signature {
+  bytes: number[];
+  offset: number;
+  extension: string;
+  mime: string;
+  description: string;
+}
+const signatures: Signature[] = [
+  {
+    bytes: [0x25, 0x50, 0x44, 0x46, 0x2d],
+    offset: 0,
+    extension: "pdf",
+    mime: "application/pdf",
+    description: "PDF header",
+  },
+  {
+    bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
+    offset: 0,
+    extension: "png",
+    mime: "image/png",
+    description: "PNG signature",
+  },
+  {
+    bytes: [0xff, 0xd8, 0xff],
+    offset: 0,
+    extension: "jpg",
+    mime: "image/jpeg",
+    description: "JPEG start of image",
+  },
+  {
+    bytes: [0x47, 0x49, 0x46, 0x38],
+    offset: 0,
+    extension: "gif",
+    mime: "image/gif",
+    description: "GIF header",
+  },
+  {
+    bytes: [0x50, 0x4b, 0x03, 0x04],
+    offset: 0,
+    extension: "zip",
+    mime: "application/zip",
+    description: "ZIP local header",
+  },
+  {
+    bytes: [0x1f, 0x8b, 0x08],
+    offset: 0,
+    extension: "gz",
+    mime: "application/gzip",
+    description: "gzip header",
+  },
+  {
+    bytes: [0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c],
+    offset: 0,
+    extension: "7z",
+    mime: "application/x-7z-compressed",
+    description: "7-Zip signature",
+  },
+  {
+    bytes: [0x52, 0x61, 0x72, 0x21, 0x1a, 0x07],
+    offset: 0,
+    extension: "rar",
+    mime: "application/vnd.rar",
+    description: "RAR signature",
+  },
+  {
+    bytes: [0x7f, 0x45, 0x4c, 0x46],
+    offset: 0,
+    extension: "elf",
+    mime: "application/x-elf",
+    description: "ELF executable header",
+  },
+  {
+    bytes: [0x4d, 0x5a],
+    offset: 0,
+    extension: "exe",
+    mime: "application/vnd.microsoft.portable-executable",
+    description: "DOS/PE executable header",
+  },
+  {
+    bytes: [0x00, 0x61, 0x73, 0x6d],
+    offset: 0,
+    extension: "wasm",
+    mime: "application/wasm",
+    description: "WebAssembly module header",
+  },
+  {
+    bytes: [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1],
+    offset: 0,
+    extension: "ole",
+    mime: "application/x-ole-storage",
+    description: "OLE compound file",
+  },
+  {
+    bytes: [
+      0x53, 0x51, 0x4c, 0x69, 0x74, 0x65, 0x20, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+      0x74, 0x20, 0x33, 0x00,
+    ],
+    offset: 0,
+    extension: "sqlite",
+    mime: "application/vnd.sqlite3",
+    description: "SQLite 3 header",
+  },
+];
+
+function matches(
+  bytes: Uint8Array,
+  offset: number,
+  signature: number[],
+): boolean {
+  return (
+    offset >= 0 &&
+    offset + signature.length <= bytes.length &&
+    signature.every((byte, index) => bytes[offset + index] === byte)
+  );
+}
+
+function hex(bytes: number[]): string {
+  return bytes
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join(" ")
+    .toUpperCase();
+}
+
+export function detectKnownSignature(
+  bytes: Uint8Array,
+):
+  { extension: string; mime: string; evidence: DetectionEvidence } | undefined {
+  for (const signature of signatures)
+    if (matches(bytes, signature.offset, signature.bytes))
+      return {
+        extension: signature.extension,
+        mime: signature.mime,
+        evidence: {
+          offset: signature.offset,
+          signature: hex(signature.bytes),
+          description: signature.description,
+        },
+      };
+  if (
+    bytes.length >= 12 &&
+    String.fromCharCode(...bytes.slice(0, 4)) === "RIFF" &&
+    String.fromCharCode(...bytes.slice(8, 12)) === "WEBP"
+  )
+    return {
+      extension: "webp",
+      mime: "image/webp",
+      evidence: {
+        offset: 0,
+        signature: "52 49 46 46 … 57 45 42 50",
+        description: "RIFF WebP header",
+      },
+    };
+  if (
+    bytes.length >= 12 &&
+    String.fromCharCode(...bytes.slice(4, 8)) === "ftyp"
+  )
+    return {
+      extension: "mp4",
+      mime: "video/mp4",
+      evidence: {
+        offset: 4,
+        signature: "66 74 79 70",
+        description: "ISO Base Media File Type box",
+      },
+    };
+  return undefined;
+}
+
+export function findEmbeddedSignatures(
+  bytes: Uint8Array,
+  baseOffset = 0,
+): DetectionEvidence[] {
+  const findings: DetectionEvidence[] = [];
+  for (const signature of signatures.filter((item) => item.bytes.length >= 4)) {
+    for (
+      let offset = 1;
+      offset <= bytes.length - signature.bytes.length;
+      offset += 1
+    )
+      if (matches(bytes, offset, signature.bytes)) {
+        findings.push({
+          offset: baseOffset + offset,
+          signature: hex(signature.bytes),
+          description: `Possible embedded ${signature.description}`,
+        });
+        break;
+      }
+  }
+  return findings.slice(0, 16);
+}
+
+export function extensionMismatch(
+  name: string,
+  extension: string | undefined,
+): string | undefined {
+  if (!extension) return undefined;
+  const claimed = name.includes(".")
+    ? name.split(".").at(-1)!.toLowerCase()
+    : "";
+  const aliases: Record<string, string[]> = {
+    jpg: ["jpg", "jpeg", "jpe"],
+    zip: ["zip", "docx", "xlsx", "pptx", "odt", "ods", "odp", "epub"],
+  };
+  if (!claimed || (aliases[extension] ?? [extension]).includes(claimed))
+    return undefined;
+  return `Filename extension .${claimed} does not match the detected .${extension} signature.`;
+}
+
+export function possibleTrailingBytes(
+  bytes: Uint8Array,
+  extension: string | undefined,
+  absoluteStart: number,
+  fileSize: number,
+): number | undefined {
+  const markers: Record<string, number[]> = {
+    jpg: [0xff, 0xd9],
+    png: [0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82],
+  };
+  const marker = extension ? markers[extension] : undefined;
+  if (!marker) return undefined;
+  for (let offset = bytes.length - marker.length; offset >= 0; offset -= 1)
+    if (matches(bytes, offset, marker)) {
+      const end = absoluteStart + offset + marker.length;
+      return Math.max(0, fileSize - end);
+    }
+  return undefined;
+}

src/file/text.ts

@@ -0,0 +1,83 @@
+export function shannonEntropy(bytes: Uint8Array): number {
+  if (!bytes.length) return 0;
+  const counts = new Uint32Array(256);
+  for (const byte of bytes) counts[byte] = counts[byte]! + 1;
+  let entropy = 0;
+  for (const count of counts)
+    if (count) {
+      const probability = count / bytes.length;
+      entropy -= probability * Math.log2(probability);
+    }
+  return entropy;
+}
+
+export function looksLikeText(bytes: Uint8Array): boolean {
+  if (!bytes.length) return true;
+  let controls = 0;
+  for (const byte of bytes.slice(0, 65_536)) {
+    if (byte === 0) return false;
+    if (byte < 9 || (byte > 13 && byte < 32)) controls += 1;
+  }
+  return controls / Math.min(bytes.length, 65_536) < 0.01;
+}
+
+export function visibleTextPreview(
+  bytes: Uint8Array,
+  maximum = 64 * 1024,
+): string {
+  const value = new TextDecoder("utf-8", { fatal: false }).decode(
+    bytes.slice(0, maximum),
+  );
+  return [...value]
+    .map((character) => {
+      const code = character.codePointAt(0)!;
+      return (code < 32 && code !== 9 && code !== 10 && code !== 13) ||
+        code === 127
+        ? `⟦${code.toString(16).padStart(2, "0").toUpperCase()}⟧`
+        : character;
+    })
+    .join("");
+}
+
+export function extractStrings(
+  bytes: Uint8Array,
+  minimum = 4,
+  maximum = 500,
+): string[] {
+  const output: string[] = [];
+  let ascii = "";
+  const flush = () => {
+    if (ascii.length >= minimum) output.push(ascii);
+    ascii = "";
+  };
+  for (const byte of bytes) {
+    if (byte >= 32 && byte <= 126) ascii += String.fromCharCode(byte);
+    else flush();
+    if (output.length >= maximum) break;
+  }
+  flush();
+  for (
+    let offset = 0;
+    offset + 1 < bytes.length && output.length < maximum;
+    offset += 1
+  ) {
+    if (offset > 0 && bytes[offset - 1]! >= 32 && bytes[offset - 1]! <= 126)
+      continue;
+    let value = "";
+    let cursor = offset;
+    while (
+      cursor + 1 < bytes.length &&
+      bytes[cursor]! >= 32 &&
+      bytes[cursor]! <= 126 &&
+      bytes[cursor + 1] === 0
+    ) {
+      value += String.fromCharCode(bytes[cursor]!);
+      cursor += 2;
+    }
+    if (value.length >= minimum) {
+      output.push(value);
+      offset = cursor - 1;
+    }
+  }
+  return [...new Set(output)].slice(0, maximum);
+}

src/main.tsx

@@ -0,0 +1,18 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./App";
+
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);
+
+if ("serviceWorker" in navigator && import.meta.env.PROD) {
+  window.addEventListener("load", () => {
+    const url = new URL("./sw.js", document.baseURI);
+    void navigator.serviceWorker
+      .register(url, { scope: new URL("./", document.baseURI).pathname })
+      .catch(() => undefined);
+  });
+}

src/styles.css

@@ -0,0 +1,396 @@
+:root {
+  --toolbox-background: #f6f7fb;
+  --toolbox-surface: #fff;
+  --toolbox-surface-soft: #eff1f7;
+  --toolbox-text: #202332;
+  --toolbox-muted: #656b7d;
+  --toolbox-border: #d9dce7;
+  --toolbox-accent: #5b4ec4;
+  --toolbox-accent-hover: #493caf;
+  --toolbox-accent-soft: #ece9ff;
+  --toolbox-accent-contrast: #fff;
+  --toolbox-focus: #137d75;
+  --toolbox-danger: #b42342;
+}
+* {
+  box-sizing: border-box;
+}
+html {
+  min-width: 20rem;
+  min-height: 100%;
+  background: var(--toolbox-background);
+  scrollbar-gutter: stable;
+}
+body {
+  min-width: 20rem;
+  min-height: 100vh;
+  margin: 0;
+  background: var(--toolbox-background);
+  color: var(--toolbox-text);
+  font-family: Inter, ui-sans-serif, system-ui, sans-serif;
+}
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
+button,
+.button {
+  min-height: 2.55rem;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.4rem;
+  padding: 0.55rem 0.8rem;
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.65rem;
+  background: var(--toolbox-surface);
+  color: var(--toolbox-text);
+  font-weight: 720;
+  cursor: pointer;
+}
+button:hover:not(:disabled),
+.button:hover {
+  border-color: var(--toolbox-accent);
+  background: var(--toolbox-surface-soft);
+}
+:where(button, input, select, textarea, a):focus-visible {
+  outline: 3px solid color-mix(in srgb, var(--toolbox-focus) 42%, transparent);
+  outline-offset: 2px;
+}
+input,
+select,
+textarea {
+  width: 100%;
+  min-height: 2.55rem;
+  padding: 0.58rem 0.7rem;
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.62rem;
+  background: var(--toolbox-surface);
+  color: var(--toolbox-text);
+}
+textarea {
+  min-height: 10rem;
+  resize: vertical;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  line-height: 1.48;
+}
+.toolbox-shell__main {
+  width: min(100%, 90rem);
+  padding: clamp(0.75rem, 1.8vw, 1.5rem);
+}
+.workbench {
+  display: grid;
+  gap: 1rem;
+}
+.hero,
+.panel {
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.9rem;
+  background: var(--toolbox-surface);
+  box-shadow: 0 8px 28px rgb(30 36 70 / 4%);
+}
+.hero {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  align-items: flex-start;
+  padding: clamp(1.1rem, 3vw, 2rem);
+}
+.hero h1,
+.panel h2,
+.panel h3,
+.help-dialog h2,
+.fatal h1 {
+  margin: 0;
+  letter-spacing: -0.025em;
+}
+.hero p:not(.eyebrow) {
+  max-width: 52rem;
+  margin: 0.55rem 0 0;
+  color: var(--toolbox-muted);
+  line-height: 1.55;
+}
+.eyebrow {
+  margin: 0 0 0.3rem;
+  color: var(--toolbox-accent);
+  font-size: 0.69rem;
+  font-weight: 820;
+  letter-spacing: 0.115em;
+  text-transform: uppercase;
+}
+.privacy-pill {
+  flex: 0 0 auto;
+  padding: 0.38rem 0.62rem;
+  border-radius: 999px;
+  background: var(--toolbox-accent-soft);
+  color: var(--toolbox-accent);
+  font-size: 0.75rem;
+  font-weight: 760;
+}
+.panel {
+  padding: 1rem;
+}
+.panel-heading {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  align-items: end;
+  margin-bottom: 0.9rem;
+}
+.capability-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 13rem), 1fr));
+  gap: 0.75rem;
+}
+.capability-grid article {
+  padding: 0.9rem;
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.72rem;
+  background: var(--toolbox-surface-soft);
+}
+.capability-grid p {
+  margin: 0.4rem 0 0;
+  color: var(--toolbox-muted);
+  line-height: 1.48;
+}
+.workspace-tabs {
+  display: flex;
+  gap: 0.4rem;
+  overflow-x: auto;
+  padding-bottom: 0.2rem;
+}
+.workspace-tabs button[aria-selected="true"] {
+  border-color: var(--toolbox-accent);
+  background: var(--toolbox-accent);
+  color: var(--toolbox-accent-contrast);
+}
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 20rem), 1fr));
+  gap: 0.85rem;
+}
+.field {
+  display: grid;
+  gap: 0.35rem;
+}
+.field > span {
+  font-size: 0.76rem;
+  font-weight: 750;
+}
+.muted {
+  color: var(--toolbox-muted);
+}
+.result {
+  padding: 0.8rem;
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.68rem;
+  background: var(--toolbox-surface-soft);
+  overflow-wrap: anywhere;
+}
+.loading,
+.fatal {
+  width: min(100% - 2rem, 60rem);
+  margin: 2rem auto;
+  padding: 1rem;
+}
+.help-dialog {
+  width: min(36rem, calc(100% - 2rem));
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.9rem;
+  background: var(--toolbox-surface);
+  color: var(--toolbox-text);
+}
+.help-dialog::backdrop {
+  background: rgb(20 24 45 / 55%);
+}
+.dialog-heading {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  align-items: start;
+}
+.workspace {
+  display: grid;
+  gap: 0.9rem;
+}
+.actions {
+  display: flex;
+  gap: 0.55rem;
+  flex-wrap: wrap;
+}
+.file-button {
+  position: relative;
+  overflow: hidden;
+}
+.file-button input {
+  position: absolute;
+  inset: 0;
+  opacity: 0;
+  cursor: pointer;
+}
+.progress {
+  display: grid;
+  grid-template-columns: minmax(10rem, 1fr) minmax(8rem, 2fr) auto;
+  gap: 0.7rem;
+  align-items: center;
+}
+.progress progress {
+  width: 100%;
+}
+.file-layout {
+  display: grid;
+  grid-template-columns: minmax(15rem, 25rem) minmax(0, 1fr);
+  gap: 1rem;
+  align-items: start;
+}
+.file-list {
+  display: grid;
+  gap: 0.35rem;
+  padding: 0.8rem;
+  max-height: 70vh;
+  overflow: auto;
+}
+.file-row {
+  justify-content: space-between;
+  min-width: 0;
+  text-align: left;
+  font-weight: 500;
+}
+.file-row[aria-current="true"] {
+  border-color: var(--toolbox-accent);
+  background: var(--toolbox-accent-soft);
+}
+.file-row > span:first-child {
+  display: grid;
+  min-width: 0;
+}
+.file-row strong,
+.file-row small {
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.file-row small {
+  color: var(--toolbox-muted);
+}
+.facts {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 13rem), 1fr));
+  gap: 0.55rem;
+  margin: 0;
+}
+.facts div {
+  min-width: 0;
+  padding: 0.7rem;
+  border-radius: 0.65rem;
+  background: var(--toolbox-surface-soft);
+}
+.facts dt {
+  color: var(--toolbox-muted);
+  font-size: 0.7rem;
+  font-weight: 760;
+}
+.facts dd {
+  margin: 0.2rem 0 0;
+  overflow-wrap: anywhere;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 0.82rem;
+}
+.warning,
+.error,
+.notice {
+  margin: 0;
+  padding: 0.7rem;
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.65rem;
+  line-height: 1.5;
+}
+.warning {
+  border-color: #d9a72e;
+  background: #fff8df;
+  color: #725000;
+}
+.error {
+  border-color: var(--toolbox-danger);
+  color: var(--toolbox-danger);
+}
+.notice {
+  background: var(--toolbox-surface-soft);
+}
+details {
+  border: 1px solid var(--toolbox-border);
+  border-radius: 0.7rem;
+}
+summary {
+  padding: 0.7rem;
+  font-weight: 750;
+  cursor: pointer;
+}
+details > :not(summary) {
+  margin: 0 0.7rem 0.7rem;
+}
+.hex-view {
+  display: grid;
+  gap: 0.65rem;
+}
+.hex-controls {
+  display: grid;
+  grid-template-columns: auto minmax(12rem, 20rem) auto;
+  gap: 0.55rem;
+  align-items: end;
+}
+.hex-table {
+  overflow-x: auto;
+  padding: 0.6rem;
+  border-radius: 0.6rem;
+  background: #171925;
+  color: #f2f4ff;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 0.78rem;
+}
+.hex-row {
+  display: grid;
+  grid-template-columns: 6rem 25rem 8rem;
+  gap: 0.7rem;
+  white-space: pre;
+}
+pre {
+  max-height: 22rem;
+  margin: 0;
+  padding: 0.75rem;
+  overflow: auto;
+  border-radius: 0.6rem;
+  background: var(--toolbox-surface-soft);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+.strings {
+  max-height: 20rem;
+  overflow: auto;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  overflow-wrap: anywhere;
+}
+.duplicate {
+  display: grid;
+  gap: 0.25rem;
+  padding: 0.7rem;
+  border-radius: 0.65rem;
+  background: var(--toolbox-surface-soft);
+}
+@media (max-width: 56rem) {
+  .file-layout {
+    grid-template-columns: 1fr;
+  }
+  .file-list {
+    max-height: 20rem;
+  }
+}
+@media (max-width: 42rem) {
+  .hero {
+    flex-direction: column;
+  }
+  .privacy-pill {
+    order: -1;
+  }
+}

src/test/setup.ts

@@ -0,0 +1,8 @@
+import "@testing-library/jest-dom/vitest";
+import { afterEach } from "vitest";
+import { cleanup } from "@testing-library/react";
+
+afterEach(() => {
+  cleanup();
+  localStorage.clear();
+});

src/toolbox/manifest.source.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://git.add-ideas.de/lotobo/toolbox-sdk/raw/branch/main/schemas/toolbox-app.v1.schema.json",
+  "schemaVersion": 1,
+  "id": "de.add-ideas.file-tools",
+  "name": "File Tools",
+  "version": "0.1.0",
+  "description": "Identify, inspect and inventory local files in the browser.",
+  "entry": "./",
+  "icon": "./favicon.svg",
+  "categories": ["files", "developer", "productivity"],
+  "tags": ["file", "hex", "checksum", "manifest", "duplicate"],
+  "integration": {
+    "contextVersion": 1,
+    "launchModes": ["navigate", "new-tab"],
+    "embedding": "unsupported"
+  },
+  "requirements": {
+    "secureContext": false,
+    "workers": true,
+    "indexedDb": false,
+    "crossOriginIsolated": false,
+    "topLevelContext": false
+  },
+  "privacy": {
+    "processing": "local",
+    "fileUploads": true,
+    "telemetry": false,
+    "label": "Inputs stay in this browser; nothing is uploaded."
+  },
+  "source": {
+    "repository": "https://git.add-ideas.de/lotobo/file-tools",
+    "license": "GPL-3.0-or-later"
+  },
+  "actions": [
+    {
+      "id": "source",
+      "label": "Source",
+      "url": "https://git.add-ideas.de/lotobo/file-tools"
+    }
+  ]
+}

src/toolbox/manifest.ts

@@ -0,0 +1,4 @@
+import { defineToolboxApp, parseToolboxApp } from "@add-ideas/toolbox-contract";
+import source from "./manifest.source.json";
+
+export const manifest = defineToolboxApp(parseToolboxApp(source));

src/version.ts

@@ -0,0 +1 @@
+export const APP_VERSION = "0.1.0";

src/vite-env.d.ts

@@ -0,0 +1 @@
+/// <reference types="vite/client" />

src/workers/inspect.worker.ts

@@ -0,0 +1,140 @@
+/// <reference lib="webworker" />
+import { sha256, sha512 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@add-ideas/toolbox-helpers";
+import { fileTypeFromBlob } from "file-type";
+import {
+  detectKnownSignature,
+  extensionMismatch,
+  findEmbeddedSignatures,
+  possibleTrailingBytes,
+} from "../file/signatures";
+import {
+  extractStrings,
+  looksLikeText,
+  shannonEntropy,
+  visibleTextPreview,
+} from "../file/text";
+import type {
+  FileInspection,
+  WorkerRequest,
+  WorkerResponse,
+} from "../file/protocol";
+
+const scope = self as DedicatedWorkerGlobalScope;
+const reply = (response: WorkerResponse) => scope.postMessage(response);
+
+async function inspect(file: File): Promise<FileInspection> {
+  const header = new Uint8Array(
+    await file.slice(0, Math.min(file.size, 1024 * 1024)).arrayBuffer(),
+  );
+  const tailStart = Math.max(0, file.size - 1024 * 1024);
+  const tail =
+    tailStart === 0
+      ? header
+      : new Uint8Array(await file.slice(tailStart).arrayBuffer());
+  const quick = detectKnownSignature(header);
+  const broad = await fileTypeFromBlob(file).catch(() => undefined);
+  const detected = broad
+    ? {
+        extension: broad.ext,
+        mime: broad.mime,
+        confidence: "signature" as const,
+      }
+    : quick
+      ? {
+          extension: quick.extension,
+          mime: quick.mime,
+          confidence: "signature" as const,
+        }
+      : looksLikeText(header)
+        ? {
+            extension: "txt",
+            mime: "text/plain",
+            confidence: "heuristic" as const,
+          }
+        : undefined;
+  const evidence = [
+    ...(quick ? [quick.evidence] : []),
+    ...findEmbeddedSignatures(header),
+    ...(tailStart ? findEmbeddedSignatures(tail, tailStart) : []),
+  ].slice(0, 32);
+  const findings: string[] = [];
+  const mismatch = extensionMismatch(file.name, detected?.extension);
+  if (mismatch) findings.push(mismatch);
+  for (const embedded of evidence.filter((item) => item.offset > 0).slice(0, 5))
+    findings.push(
+      `${embedded.description} at offset ${embedded.offset.toLocaleString()}; this is a heuristic, not proof of hidden content.`,
+    );
+  const trailing = possibleTrailingBytes(
+    tail,
+    detected?.extension,
+    tailStart,
+    file.size,
+  );
+  if (trailing)
+    findings.push(
+      `${trailing.toLocaleString()} byte${trailing === 1 ? "" : "s"} follow the last recognised ${detected?.extension?.toUpperCase()} end marker.`,
+    );
+  if (!detected)
+    findings.push(
+      "No supported signature was recognised; this does not prove that the file is invalid or empty.",
+    );
+  return {
+    detected,
+    evidence,
+    entropy: shannonEntropy(header),
+    sampleBytes: header.byteLength,
+    textPreview: looksLikeText(header) ? visibleTextPreview(header) : undefined,
+    strings: extractStrings(header),
+    findings,
+  };
+}
+
+async function hash(file: File, id: number) {
+  const left = sha256.create();
+  const right = sha512.create();
+  const chunkSize = 1024 * 1024;
+  for (let offset = 0; offset < file.size; offset += chunkSize) {
+    const chunk = new Uint8Array(
+      await file
+        .slice(offset, Math.min(file.size, offset + chunkSize))
+        .arrayBuffer(),
+    );
+    left.update(chunk);
+    right.update(chunk);
+    reply({
+      id,
+      type: "progress",
+      loaded: Math.min(file.size, offset + chunk.byteLength),
+      total: file.size,
+    });
+  }
+  reply({
+    id,
+    type: "hash",
+    sha256: bytesToHex(left.digest()),
+    sha512: bytesToHex(right.digest()),
+  });
+}
+
+scope.addEventListener("message", (event: MessageEvent<WorkerRequest>) => {
+  const request = event.data;
+  void (async () => {
+    try {
+      if (request.task === "inspect")
+        reply({
+          id: request.id,
+          type: "inspection",
+          result: await inspect(request.file),
+        });
+      else await hash(request.file, request.id);
+    } catch (error) {
+      reply({
+        id: request.id,
+        type: "error",
+        message:
+          error instanceof Error ? error.message : "Worker operation failed.",
+      });
+    }
+  })();
+});

tests/browser/app.spec.ts

@@ -0,0 +1,75 @@
+import { expect, test, type Page, type Response } from "@playwright/test";
+
+const ORIGIN = "http://127.0.0.1:4173";
+async function localOnly(page: Page) {
+  const external: string[] = [];
+  await page.route("**/*", async (route) => {
+    const url = new URL(route.request().url());
+    if (url.origin !== ORIGIN) {
+      external.push(url.href);
+      await route.abort();
+    } else await route.continue();
+  });
+  return external;
+}
+
+test("runs from a nested path without external requests", async ({ page }) => {
+  const errors: string[] = [];
+  page.on("pageerror", (error) => errors.push(error.message));
+  page.on("console", (message) => {
+    if (message.type() === "error") errors.push(message.text());
+  });
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/file/");
+  await expect(page.getByRole("heading", { name: "File Tools" })).toBeVisible();
+  expect(external).toEqual([]);
+  expect(errors).toEqual([]);
+});
+
+test("inspects and hashes a local file in an immutable module worker", async ({
+  page,
+}) => {
+  const external = await localOnly(page);
+  const responses: Response[] = [];
+  page.on("response", (response) => responses.push(response));
+  await page.goto("/deep/nested/file/");
+  await page
+    .locator('input[type="file"]')
+    .first()
+    .setInputFiles("tests/fixtures/hello.txt");
+  await expect(page.getByRole("heading", { name: "hello.txt" })).toBeVisible();
+  await expect(
+    page.getByText("text/plain (.txt)", { exact: true }),
+  ).toBeVisible();
+  await page.getByRole("button", { name: "Hash", exact: true }).click();
+  await expect(page.getByText(/^[0-9a-f]{64}$/u)).toBeVisible();
+  const worker = responses.find((response) =>
+    /\/deep\/nested\/file\/assets\/inspect\.worker-[\w-]+\.js$/u.test(
+      new URL(response.url()).pathname,
+    ),
+  );
+  expect(worker, "inspection worker request").toBeTruthy();
+  expect(worker!.headers()["content-type"]).toContain("text/javascript");
+  expect(worker!.headers()["cache-control"]).toBe(
+    "public, max-age=31536000, immutable",
+  );
+  expect(new URL(worker!.url()).origin).toBe(ORIGIN);
+  expect(external).toEqual([]);
+});
+
+test("serves the release identity and hardened headers", async ({
+  request,
+}) => {
+  const index = await request.get("/deep/nested/file/");
+  expect(index.ok()).toBe(true);
+  expect(index.headers()["content-security-policy"]).toContain(
+    "default-src 'self'",
+  );
+  expect(await index.text()).not.toMatch(/\b(?:src|href)=["']\//u);
+  const manifest = await request.get("/deep/nested/file/toolbox-app.json");
+  await expect(manifest.json()).resolves.toMatchObject({
+    id: "de.add-ideas.file-tools",
+    version: "0.1.0",
+    entry: "./",
+  });
+});

tests/components/app.test.tsx

@@ -0,0 +1,17 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { App } from "../../src/App";
+
+describe("File Tools", () => {
+  it("renders the local workbench and standard shell", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("Not found", { status: 404 })),
+    );
+    render(<App />);
+    expect(
+      await screen.findByRole("heading", { name: "File Tools" }),
+    ).toBeVisible();
+    expect(await screen.findByText("Browser-local")).toBeVisible();
+  });
+});

tests/file/core.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+import { manifestCsv, manifestJson } from "../../src/file/manifest";
+import {
+  detectKnownSignature,
+  extensionMismatch,
+} from "../../src/file/signatures";
+import {
+  extractStrings,
+  looksLikeText,
+  shannonEntropy,
+} from "../../src/file/text";
+
+describe("file signatures", () => {
+  it("detects PNG without claiming parser validation", () =>
+    expect(
+      detectKnownSignature(
+        Uint8Array.of(0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a),
+      ),
+    ).toMatchObject({ extension: "png", mime: "image/png" }));
+  it("accounts for container extension aliases", () => {
+    expect(extensionMismatch("book.epub", "zip")).toBeUndefined();
+    expect(extensionMismatch("image.txt", "png")).toMatch(/does not match/u);
+  });
+});
+
+describe("bounded text helpers", () => {
+  it("extracts ASCII and UTF-16LE strings", () =>
+    expect(
+      extractStrings(
+        Uint8Array.from([65, 66, 67, 68, 0, 90, 0, 89, 0, 88, 0, 87, 0]),
+      ),
+    ).toEqual(expect.arrayContaining(["ABCD", "ZYXW"])));
+  it("distinguishes NUL-containing binary data", () =>
+    expect(looksLikeText(Uint8Array.of(65, 0, 66))).toBe(false));
+  it("measures a uniform byte distribution", () =>
+    expect(
+      shannonEntropy(Uint8Array.from({ length: 256 }, (_, index) => index)),
+    ).toBeCloseTo(8));
+});
+
+describe("manifests", () => {
+  const records = [
+    {
+      name: "=formula",
+      path: "=formula",
+      size: 1,
+      type: "text/plain",
+      lastModified: 0,
+    },
+  ];
+  it("is deterministic", () =>
+    expect(manifestJson(records)).toBe(manifestJson(records)));
+  it("neutralises spreadsheet-leading formulas", () =>
+    expect(manifestCsv(records)).toContain("'=formula"));
+});

tests/fixtures/hello.txt

@@ -0,0 +1 @@
+Hello local file

tsconfig.app.json

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "types": ["vite/client"],
+    "allowArbitraryExtensions": true,
+    "skipLibCheck": true,
+    "moduleResolution": "Bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "useDefineForClassFields": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true
+  },
+  "include": ["src", "tests"]
+}

tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "files": [],
+  "references": [
+    {
+      "path": "./tsconfig.app.json"
+    },
+    {
+      "path": "./tsconfig.node.json"
+    }
+  ]
+}

tsconfig.node.json

@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "types": ["node"],
+    "skipLibCheck": true,
+    "moduleResolution": "Bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true
+  },
+  "include": [
+    "vite.config.ts",
+    "playwright.config.ts",
+    "eslint.config.mjs",
+    "scripts/**/*.mjs"
+  ]
+}

vite.config.ts

@@ -0,0 +1,16 @@
+/// <reference types="vitest/config" />
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+
+export default defineConfig({
+  base: "./",
+  plugins: [react()],
+  test: {
+    environment: "jsdom",
+    setupFiles: "./src/test/setup.ts",
+    css: true,
+    maxWorkers: 2,
+    restoreMocks: true,
+    exclude: ["tests/browser/**", "node_modules/**", "dist/**"],
+  },
+});