From 6381ba300ae81033ef8e679c0ccc1c4133c242bb Mon Sep 17 00:00:00 2001
From: baixiangcpp <baixiangcpp@gmail.com>
Date: Mon, 29 Jun 2026 15:40:36 +0800
Subject: [PATCH] Fix privacy trust and tool robustness issues

---
 .../layout/verification-mode-panel.tsx        |  4 ++
 src/core/files/file-input-policy.ts           | 25 ++++----
 src/core/i18n/translations/de.json            |  1 +
 src/core/i18n/translations/en.json            |  1 +
 src/core/i18n/translations/fr.json            |  1 +
 src/core/i18n/translations/ja.json            |  1 +
 src/core/i18n/translations/ko.json            |  1 +
 src/core/i18n/translations/zh-CN.json         |  1 +
 src/core/i18n/translations/zh-TW.json         |  1 +
 src/core/storage/tool-persistence-policy.ts   | 42 +++++++++---
 src/core/trust/verification-mode.ts           | 64 +++++++++++++++++--
 src/features/privacy/local-data-controls.tsx  |  7 +-
 .../tools/csv-json-converter/logic.ts         | 16 ++++-
 src/features/tools/jwt-verifier/logic.ts      | 24 ++++---
 src/features/tools/jwt-verifier/page.tsx      | 10 ++-
 .../tools/oauth-jwks-workbench/page.tsx       | 38 +++++++----
 .../bf-025-bf-031-image-file-safety.test.tsx  |  6 +-
 tests/component/jwt-verifier-page.test.tsx    | 17 +++++
 tests/component/privacy-page.test.tsx         | 57 +++++++++++++----
 .../verification-mode-panel.test.tsx          | 17 ++++-
 .../verification-mode-acceptance.test.ts      |  5 ++
 tests/unit/csv-json-task-logic.test.ts        | 38 +++++++++++
 tests/unit/file-input-policy.test.ts          | 19 ++++++
 tests/unit/jwt-verifier-claims.test.ts        |  3 +
 24 files changed, 331 insertions(+), 68 deletions(-)

diff --git a/src/components/layout/verification-mode-panel.tsx b/src/components/layout/verification-mode-panel.tsx
index 76c16964..2ddadea8 100644
--- a/src/components/layout/verification-mode-panel.tsx
+++ b/src/components/layout/verification-mode-panel.tsx
@@ -51,6 +51,7 @@ export function VerificationModePanel({ pathname }: VerificationModePanelProps)
         ariaLabel: requireTranslationValue(t.pages.verification_mode_aria_label, "pages.verification_mode_aria_label"),
         title: requireTranslationValue(t.pages.verification_mode_title, "pages.verification_mode_title"),
         description: requireTranslationValue(t.pages.verification_mode_description, "pages.verification_mode_description"),
+        scope: requireTranslationValue(t.pages.verification_mode_scope, "pages.verification_mode_scope"),
         on: requireTranslationValue(t.pages.verification_mode_on, "pages.verification_mode_on"),
         off: requireTranslationValue(t.pages.verification_mode_off, "pages.verification_mode_off"),
         browserLocalTool: requireTranslationValue(t.pages.verification_mode_browser_local_tool, "pages.verification_mode_browser_local_tool"),
@@ -199,6 +200,9 @@ export function VerificationModePanel({ pathname }: VerificationModePanelProps)
                     <p className="mt-1 text-xs leading-relaxed text-muted-foreground">
                         {copy.description}
                     </p>
+                    <p className="mt-1 text-xs leading-relaxed text-muted-foreground">
+                        {copy.scope}
+                    </p>
                 </div>
                 <div className="flex items-center gap-1">
                     <Button
diff --git a/src/core/files/file-input-policy.ts b/src/core/files/file-input-policy.ts
index 38d317e4..238099a9 100644
--- a/src/core/files/file-input-policy.ts
+++ b/src/core/files/file-input-policy.ts
@@ -88,30 +88,30 @@ export const FILE_INPUT_POLICIES = {
     },
     "image-standard": {
         id: "image-standard",
-        accept: "image/*",
-        description: "Image files up to 12 MB and 24 MP",
+        accept: ".png,.jpg,.jpeg,.webp,.gif,.avif,image/png,image/jpeg,image/webp,image/gif,image/avif",
+        description: "Raster image files up to 12 MB and 24 MP. Use SVG tools for SVG files.",
         maxBytes: 12 * 1024 * 1024,
         maxPixels: 24_000_000,
-        allowedMimePrefixes: ["image/"],
-        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg", ".avif"],
+        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif", ".avif"],
+        allowedMimeTypes: ["image/png", "image/jpeg", "image/webp", "image/gif", "image/avif"],
     },
     "image-compact": {
         id: "image-compact",
-        accept: "image/*",
-        description: "Image files up to 10 MB and 16 MP",
+        accept: ".png,.jpg,.jpeg,.webp,.gif,.avif,image/png,image/jpeg,image/webp,image/gif,image/avif",
+        description: "Raster image files up to 10 MB and 16 MP. Use SVG tools for SVG files.",
         maxBytes: 10 * 1024 * 1024,
         maxPixels: 16_000_000,
-        allowedMimePrefixes: ["image/"],
-        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg", ".avif"],
+        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif", ".avif"],
+        allowedMimeTypes: ["image/png", "image/jpeg", "image/webp", "image/gif", "image/avif"],
     },
     "image-logo": {
         id: "image-logo",
-        accept: "image/*",
-        description: "Logo/avatar images up to 2 MB and 4 MP",
+        accept: ".png,.jpg,.jpeg,.webp,.gif,image/png,image/jpeg,image/webp,image/gif",
+        description: "Raster logo/avatar images up to 2 MB and 4 MP. Use SVG tools for SVG files.",
         maxBytes: 2 * 1024 * 1024,
         maxPixels: 4_000_000,
-        allowedMimePrefixes: ["image/"],
-        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg"],
+        allowedExtensions: [".png", ".jpg", ".jpeg", ".webp", ".gif"],
+        allowedMimeTypes: ["image/png", "image/jpeg", "image/webp", "image/gif"],
     },
     svg: {
         id: "svg",
@@ -165,6 +165,7 @@ function hasAllowedFileType(file: File, policy: FileInputPolicy): boolean {
     const extension = fileExtension(file)
     const hasTypeRules = Boolean(policy.allowedMimePrefixes?.length || policy.allowedMimeTypes?.length || policy.allowedExtensions?.length)
     if (!hasTypeRules) return true
+    if (extension && policy.allowedExtensions?.length && !policy.allowedExtensions.includes(extension)) return false
     if (mime && policy.allowedMimePrefixes?.some((prefix) => mime.startsWith(prefix))) return true
     if (mime && policy.allowedMimeTypes?.includes(mime)) return true
     if (extension && policy.allowedExtensions?.includes(extension)) return true
diff --git a/src/core/i18n/translations/de.json b/src/core/i18n/translations/de.json
index 5dba428a..cf6e74a6 100644
--- a/src/core/i18n/translations/de.json
+++ b/src/core/i18n/translations/de.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "Prüfmodus",
     "verification_mode_title": "Prüfmodus",
     "verification_mode_description": "Browserinterne Hilfe. Erfasst Anfrage-Hosts und Storage-Schlüssel, aber keine Payloads, Headers, Query-Strings oder Werte.",
+    "verification_mode_scope": "Umfang: nur fetch, sendBeacon und Storage-Änderungen. Nutze DevTools Network für vom Browser geladene Bilder, Skripte, Downloads und andere Ressourcen.",
     "verification_mode_on": "Ein",
     "verification_mode_off": "Aus",
     "verification_mode_browser_local_tool": "Browser-lokales Tool",
diff --git a/src/core/i18n/translations/en.json b/src/core/i18n/translations/en.json
index 13b866b9..1efdac36 100644
--- a/src/core/i18n/translations/en.json
+++ b/src/core/i18n/translations/en.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "Verification mode",
     "verification_mode_title": "Verification mode",
     "verification_mode_description": "Browser-only aid. It records request hosts and storage keys, not payloads, headers, query strings, or values.",
+    "verification_mode_scope": "Scope: fetch, sendBeacon, and storage changes only. Use DevTools Network for browser-loaded images, scripts, downloads, and other resource loads.",
     "verification_mode_on": "On",
     "verification_mode_off": "Off",
     "verification_mode_browser_local_tool": "Browser-local tool",
diff --git a/src/core/i18n/translations/fr.json b/src/core/i18n/translations/fr.json
index f5ee46ec..96db93db 100644
--- a/src/core/i18n/translations/fr.json
+++ b/src/core/i18n/translations/fr.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "Mode de vérification",
     "verification_mode_title": "Mode de vérification",
     "verification_mode_description": "Aide dans le navigateur. Il enregistre les hôtes de requête et clés de stockage, pas les payloads, headers, chaînes de requête ni valeurs.",
+    "verification_mode_scope": "Portée : fetch, sendBeacon et changements de stockage seulement. Utilisez DevTools Network pour les images, scripts, téléchargements et autres ressources chargés par le navigateur.",
     "verification_mode_on": "Activé",
     "verification_mode_off": "Désactivé",
     "verification_mode_browser_local_tool": "Outil local au navigateur",
diff --git a/src/core/i18n/translations/ja.json b/src/core/i18n/translations/ja.json
index 1daf20c6..a560bbbd 100644
--- a/src/core/i18n/translations/ja.json
+++ b/src/core/i18n/translations/ja.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "検証モード",
     "verification_mode_title": "検証モード",
     "verification_mode_description": "ブラウザー内だけの補助機能です。リクエスト先ホストとストレージキーを記録し、payload、headers、クエリ文字列、値は記録しません。",
+    "verification_mode_scope": "範囲: fetch、sendBeacon、ストレージ変更のみを対象にします。ブラウザーが読み込む画像、スクリプト、ダウンロード、その他のリソースは DevTools Network で確認してください。",
     "verification_mode_on": "オン",
     "verification_mode_off": "オフ",
     "verification_mode_browser_local_tool": "ブラウザー内ツール",
diff --git a/src/core/i18n/translations/ko.json b/src/core/i18n/translations/ko.json
index 4de0058b..d189480d 100644
--- a/src/core/i18n/translations/ko.json
+++ b/src/core/i18n/translations/ko.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "확인 모드",
     "verification_mode_title": "확인 모드",
     "verification_mode_description": "브라우저 안에서만 쓰는 보조 기능입니다. 요청 호스트와 저장소 키를 기록하며 payload, headers, 쿼리 문자열, 값은 기록하지 않습니다.",
+    "verification_mode_scope": "범위: fetch, sendBeacon, 저장소 변경만 관찰합니다. 브라우저가 로드하는 이미지, 스크립트, 다운로드 및 기타 리소스는 DevTools Network로 확인하세요.",
     "verification_mode_on": "켜짐",
     "verification_mode_off": "꺼짐",
     "verification_mode_browser_local_tool": "브라우저 로컬 도구",
diff --git a/src/core/i18n/translations/zh-CN.json b/src/core/i18n/translations/zh-CN.json
index 956abf33..e2fe27ef 100644
--- a/src/core/i18n/translations/zh-CN.json
+++ b/src/core/i18n/translations/zh-CN.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "验证模式",
     "verification_mode_title": "验证模式",
     "verification_mode_description": "仅在浏览器内辅助验证。它记录请求主机和存储键，不记录 payload、headers、查询字符串或存储值。",
+    "verification_mode_scope": "范围：仅覆盖 fetch、sendBeacon 和存储变更。浏览器加载的图片、脚本、下载和其他资源请求仍请使用 DevTools Network 确认。",
     "verification_mode_on": "开启",
     "verification_mode_off": "关闭",
     "verification_mode_browser_local_tool": "浏览器本地工具",
diff --git a/src/core/i18n/translations/zh-TW.json b/src/core/i18n/translations/zh-TW.json
index e23ac271..7b82ce5d 100644
--- a/src/core/i18n/translations/zh-TW.json
+++ b/src/core/i18n/translations/zh-TW.json
@@ -3225,6 +3225,7 @@
     "verification_mode_aria_label": "驗證模式",
     "verification_mode_title": "驗證模式",
     "verification_mode_description": "僅在瀏覽器內輔助驗證。它記錄請求主機和儲存鍵，不記錄 payload、headers、查詢字串或儲存值。",
+    "verification_mode_scope": "範圍：僅涵蓋 fetch、sendBeacon 與儲存變更。瀏覽器載入的圖片、指令碼、下載與其他資源請求仍請使用 DevTools Network 確認。",
     "verification_mode_on": "開啟",
     "verification_mode_off": "關閉",
     "verification_mode_browser_local_tool": "瀏覽器本地工具",
diff --git a/src/core/storage/tool-persistence-policy.ts b/src/core/storage/tool-persistence-policy.ts
index 0c0106fe..f39a317d 100644
--- a/src/core/storage/tool-persistence-policy.ts
+++ b/src/core/storage/tool-persistence-policy.ts
@@ -1,4 +1,5 @@
 import { removeStorageKey, writeStorageString } from "./tool-persistence"
+import { getAnalyticsOptOutStorageKey } from "@/core/analytics/preferences"
 
 export type ToolInputPersistenceMode = true | false | "opt-in"
 
@@ -28,24 +29,49 @@ export function enforceToolInputPersistencePolicy(policy: ToolPersistencePolicy,
     writeStorageString(policy.inputStorageKey, input)
 }
 
-export function clearByteflowLocalData(): number {
+export type ClearByteflowBrowserDataOptions = {
+    preserveAnalyticsOptOut?: boolean
+    includeSessionStorage?: boolean
+}
+
+function collectByteflowStorageKeys(
+    storage: Storage,
+    preservedKeys: ReadonlySet<string>,
+): string[] {
+    const keys: string[] = []
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index)
+        if (key?.startsWith("byteflow:") && !preservedKeys.has(key)) keys.push(key)
+    }
+    return keys
+}
+
+export function clearByteflowBrowserData(options: ClearByteflowBrowserDataOptions = {}): number {
     if (typeof window === "undefined") return 0
 
+    const preserveAnalyticsOptOut = options.preserveAnalyticsOptOut ?? true
+    const preservedKeys = new Set<string>()
+    if (preserveAnalyticsOptOut) preservedKeys.add(getAnalyticsOptOutStorageKey())
+
     let removed = 0
-    const keys: string[] = []
     try {
-        for (let index = 0; index < window.localStorage.length; index += 1) {
-            const key = window.localStorage.key(index)
-            if (key?.startsWith("byteflow:")) keys.push(key)
-        }
-
-        keys.forEach((key) => {
+        collectByteflowStorageKeys(window.localStorage, preservedKeys).forEach((key) => {
             window.localStorage.removeItem(key)
             removed += 1
         })
+        if (options.includeSessionStorage ?? true) {
+            collectByteflowStorageKeys(window.sessionStorage, preservedKeys).forEach((key) => {
+                window.sessionStorage.removeItem(key)
+                removed += 1
+            })
+        }
     } catch {
         return removed
     }
 
     return removed
 }
+
+export function clearByteflowLocalData(): number {
+    return clearByteflowBrowserData()
+}
diff --git a/src/core/trust/verification-mode.ts b/src/core/trust/verification-mode.ts
index 9315bd2f..282fca9b 100644
--- a/src/core/trust/verification-mode.ts
+++ b/src/core/trust/verification-mode.ts
@@ -15,13 +15,69 @@ export type VerificationStorageEntry = {
     timestamp: string
 }
 
-export const ALLOWED_STORAGE_KEY_PREFIXES = [
-    "byteflow:",
-    "theme",
+export type VerificationStorageKeyPolicy = {
+    exactKeys: readonly string[]
+    safePrefixes: readonly string[]
+    reviewSubstrings: readonly string[]
+}
+
+export const VERIFICATION_STORAGE_KEY_POLICY: VerificationStorageKeyPolicy = {
+    exactKeys: [
+        "theme",
+        "byteflow:analytics:opt-out",
+        "byteflow:tools:favorites",
+        "byteflow:tools:recent",
+        "byteflow:preferred-locale",
+        "byteflow:pwa-install:visit-count",
+        "byteflow:pwa-install:dismissed-until",
+        "byteflow:pwa-install:session-prompted",
+        "byteflow:pwa-install:installed",
+        "byteflow:base64:mode",
+        "byteflow:base64:operation",
+        "byteflow:csv-json-converter:direction",
+        "byteflow:csv-json-converter:delimiter",
+        "byteflow:csv-json-converter:has-header",
+        "byteflow:csv-json-converter:type-inference",
+        "byteflow:json-formatter:view-mode",
+        "byteflow:jwt-workbench:algorithm",
+        "byteflow:pipeline-builder:onboarding-dismissed",
+        "byteflow:url-encode-decode:strategy",
+        "byteflow:url-encode-decode:operation",
+        "byteflow:yaml-json-converter:mode",
+        "byteflow:yaml-json-converter:from-format",
+        "byteflow:yaml-json-converter:to-format",
+    ],
+    safePrefixes: [],
+    reviewSubstrings: [
+        "input",
+        "output",
+        "payload",
+        "token",
+        "jwt",
+        "secret",
+        "password",
+        "file",
+        "blob",
+        "image",
+        "log",
+        "har",
+        "request",
+        "response",
+        "body",
+        "content",
+    ],
+} as const
+
+const REVIEW_STORAGE_KEY_SUBSTRINGS = [
+    ...VERIFICATION_STORAGE_KEY_POLICY.reviewSubstrings,
 ] as const
 
 export function isAllowedVerificationStorageKey(key: string): boolean {
-    return ALLOWED_STORAGE_KEY_PREFIXES.some((prefix) => key === prefix || key.startsWith(prefix))
+    const normalized = key.trim().toLowerCase()
+    if (!normalized) return false
+    if (REVIEW_STORAGE_KEY_SUBSTRINGS.some((substring) => normalized.includes(substring))) return false
+    if (VERIFICATION_STORAGE_KEY_POLICY.exactKeys.some((allowedKey) => allowedKey.toLowerCase() === normalized)) return true
+    return VERIFICATION_STORAGE_KEY_POLICY.safePrefixes.some((prefix) => normalized.startsWith(prefix.toLowerCase()))
 }
 
 export function sanitizeVerificationUrl(input: unknown, baseHref: string) {
diff --git a/src/features/privacy/local-data-controls.tsx b/src/features/privacy/local-data-controls.tsx
index 632ca56a..3ce87112 100644
--- a/src/features/privacy/local-data-controls.tsx
+++ b/src/features/privacy/local-data-controls.tsx
@@ -18,7 +18,7 @@ import {
     readFavoriteToolKeys,
     readRecentToolKeys,
 } from "@/core/storage/tool-discovery-state"
-import { clearByteflowLocalData } from "@/core/storage/tool-persistence-policy"
+import { clearByteflowBrowserData } from "@/core/storage/tool-persistence-policy"
 import { clearSavedRecipes, countSavedRecipes, isRecipeStoreAvailable } from "@/features/pipeline/recipe-store"
 
 type LocalDataSummary = {
@@ -98,7 +98,10 @@ export function LocalDataControls() {
 
     const clearData = async () => {
         setPendingAction("all")
-        const removed = clearByteflowLocalData()
+        const removed = clearByteflowBrowserData({
+            preserveAnalyticsOptOut: true,
+            includeSessionStorage: true,
+        })
         let recipeCount = 0
         if (isRecipeStoreAvailable()) {
             const countResult = await countSavedRecipes()
diff --git a/src/features/tools/csv-json-converter/logic.ts b/src/features/tools/csv-json-converter/logic.ts
index e8411eda..fab8e307 100644
--- a/src/features/tools/csv-json-converter/logic.ts
+++ b/src/features/tools/csv-json-converter/logic.ts
@@ -126,6 +126,16 @@ function serializeCsvCell(value: unknown): string {
     return String(value)
 }
 
+function isPlainObjectRow(value: unknown): value is Record<string, unknown> {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+}
+
+function describeJsonRowShape(value: unknown): string {
+    if (value === null) return "null"
+    if (Array.isArray(value)) return "array"
+    return typeof value
+}
+
 export function jsonToCsv(json: string, delimiter: string, includeHeader: boolean): string {
     const parsed = JSON.parse(json)
     const effectiveDelimiter = delimiter === "auto" ? "," : delimiter
@@ -136,7 +146,11 @@ export function jsonToCsv(json: string, delimiter: string, includeHeader: boolea
 
     if (parsed.length === 0) return ""
 
-    if (typeof parsed[0] === "object" && !Array.isArray(parsed[0])) {
+    if (parsed.some(isPlainObjectRow)) {
+        const invalidRowIndex = parsed.findIndex((item) => !isPlainObjectRow(item))
+        if (invalidRowIndex !== -1) {
+            throw new Error(`JSON array rows must be objects when converting to header-based CSV. Row ${invalidRowIndex + 1} is ${describeJsonRowShape(parsed[invalidRowIndex])}.`)
+        }
         const flattened = parsed.map((item) => flattenObject(item as Record<string, unknown>))
         const allKeys = [...new Set(flattened.flatMap((obj) => Object.keys(obj)))]
 
diff --git a/src/features/tools/jwt-verifier/logic.ts b/src/features/tools/jwt-verifier/logic.ts
index 817de9cf..1ec4d168 100644
--- a/src/features/tools/jwt-verifier/logic.ts
+++ b/src/features/tools/jwt-verifier/logic.ts
@@ -60,9 +60,14 @@ function hashForHmacAlgorithm(algorithm: SupportedHmacJwtAlgorithm): "SHA-256" |
     return "SHA-256"
 }
 
-export function classifyJwtVerificationAlgorithm(algorithm: string): "hmac" | "unsupported" | "unsigned" {
-    if (algorithm.toLowerCase() === "none") return "unsigned"
-    if (isSupportedHmacAlgorithm(algorithm)) return "hmac"
+export function normalizeJwtAlgorithm(algorithm: unknown): string {
+    return typeof algorithm === "string" && algorithm.trim() ? algorithm : "non-string alg"
+}
+
+export function classifyJwtVerificationAlgorithm(algorithm: unknown): "hmac" | "unsupported" | "unsigned" {
+    const normalizedAlgorithm = normalizeJwtAlgorithm(algorithm)
+    if (normalizedAlgorithm.toLowerCase() === "none") return "unsigned"
+    if (isSupportedHmacAlgorithm(normalizedAlgorithm)) return "hmac"
     return "unsupported"
 }
 
@@ -81,15 +86,16 @@ async function verifyHmacJwt(token: string, secret: string, algorithm: Supported
     return bytesToBase64Url(new Uint8Array(signature)) === parts[2]
 }
 
-export async function verifyJwtSignature(token: string, secret: string, algorithm: string): Promise<JwtSignatureVerificationResult | null> {
-    const classification = classifyJwtVerificationAlgorithm(algorithm)
+export async function verifyJwtSignature(token: string, secret: string, algorithm: unknown): Promise<JwtSignatureVerificationResult | null> {
+    const normalizedAlgorithm = normalizeJwtAlgorithm(algorithm)
+    const classification = classifyJwtVerificationAlgorithm(normalizedAlgorithm)
     if (classification === "unsigned") return { status: "unsigned", algorithm: "none" }
-    if (classification === "unsupported") return { status: "unsupported", algorithm }
+    if (classification === "unsupported") return { status: "unsupported", algorithm: normalizedAlgorithm }
     if (!secret.trim()) return null
-    if (!isSupportedHmacAlgorithm(algorithm)) return { status: "unsupported", algorithm }
+    if (!isSupportedHmacAlgorithm(normalizedAlgorithm)) return { status: "unsupported", algorithm: normalizedAlgorithm }
 
-    const valid = await verifyHmacJwt(token, secret, algorithm)
-    return { status: valid ? "valid" : "invalid", algorithm }
+    const valid = await verifyHmacJwt(token, secret, normalizedAlgorithm)
+    return { status: valid ? "valid" : "invalid", algorithm: normalizedAlgorithm }
 }
 
 export function parseUnixTimestampClaim(value: unknown): { ok: true; seconds: number; iso: string } | { ok: false; error: string } {
diff --git a/src/features/tools/jwt-verifier/page.tsx b/src/features/tools/jwt-verifier/page.tsx
index 2e78baa7..5af72d46 100644
--- a/src/features/tools/jwt-verifier/page.tsx
+++ b/src/features/tools/jwt-verifier/page.tsx
@@ -15,6 +15,7 @@ import {
     decodeHeader,
     decodePayload,
     verifyJwtSignature,
+    normalizeJwtAlgorithm,
     type JwtSignatureVerificationResult,
 } from "./logic"
 
@@ -63,17 +64,18 @@ export function JwtVerifierPage() {
     const [claims, setClaims] = React.useState<{ label: string; status: string; value: string }[]>([])
 
     const verify = async () => {
-        if (!token.trim()) return
+        if (!token.trim()) return { status: "failed" as const, message: toolT.token_label }
 
         const h = decodeHeader(token)
         const p = decodePayload(token)
         setHeader(h)
         setPayload(p)
-        const alg = h?.alg as string || "unknown"
+        const alg = normalizeJwtAlgorithm(h?.alg)
 
         if (p) setClaims(checkClaims(p, claimLabels))
 
         setVerifyResult(await verifyJwtSignature(token, secret, alg))
+        return { status: "success" as const }
     }
     const clearAll = () => {
         setToken("")
@@ -103,8 +105,10 @@ export function JwtVerifierPage() {
             id: "verify",
             label: toolT.verify_action,
             icon: ShieldCheck,
-            onClick: () => { void verify() },
+            onClick: verify,
             variant: "default",
+            disabled: !token.trim(),
+            disabledReason: toolT.token_label,
         },
     ]
 
diff --git a/src/features/tools/oauth-jwks-workbench/page.tsx b/src/features/tools/oauth-jwks-workbench/page.tsx
index 15ae3184..21b16fec 100644
--- a/src/features/tools/oauth-jwks-workbench/page.tsx
+++ b/src/features/tools/oauth-jwks-workbench/page.tsx
@@ -49,43 +49,59 @@ export function OauthJwksWorkbenchPage() {
         }
     }, [keyOptions, mode, selectedKey])
 
-    const run = React.useCallback(() => {
+    const run = React.useCallback(async () => {
         setError(null)
         if (mode === "pkce") {
-            void generatePkcePair().then((pair) => setOutput(JSON.stringify(pair, null, 2))).catch((runError: unknown) => setError(runError instanceof Error ? runError.message : String(runError)))
-            return
+            try {
+                const pair = await generatePkcePair()
+                setOutput(JSON.stringify(pair, null, 2))
+                return { status: "success" as const }
+            } catch (runError: unknown) {
+                setError(runError instanceof Error ? runError.message : String(runError))
+                return { status: "failed" as const }
+            }
         }
         try {
             const keys = summarizeJwks(jwks)
             setOutput(JSON.stringify({ keys }, null, 2))
-            void verifyJwtWithJwks(token, jwks, { selectedKey })
-                .then((report) => setOutput(JSON.stringify({ keys, verification: report }, null, 2)))
-                .catch((verifyError: unknown) => {
-                    setOutput(JSON.stringify({ keys, verification: { valid: false, message: verifyError instanceof Error ? verifyError.message : String(verifyError) } }, null, 2))
-                })
+            try {
+                const report = await verifyJwtWithJwks(token, jwks, { selectedKey })
+                setOutput(JSON.stringify({ keys, verification: report }, null, 2))
+            } catch (verifyError: unknown) {
+                setOutput(JSON.stringify({ keys, verification: { valid: false, message: verifyError instanceof Error ? verifyError.message : String(verifyError) } }, null, 2))
+            }
+            return { status: "success" as const }
         } catch (runError) {
             setOutput("")
             setError(runError instanceof Error ? runError.message : String(runError))
+            return { status: "failed" as const }
         }
     }, [jwks, mode, selectedKey, token])
 
     const copyOutput = async () => {
-        if (!output) return
+        if (!output) {
+            return { status: "failed" as const }
+        }
         const result = await safeClipboardWrite(output)
         if (!result.ok) {
             toast.error(t.common.copy_failed)
-            return
+            return { status: "failed" as const, message: t.common.copy_failed }
         }
         toast.success(t.common.copied)
+        return { status: "success" as const, message: t.common.copied }
     }
 
+    /*
+     * ToolActionBar depends on async actions returning their Promise so pending
+     * and failure announcements reflect the actual browser work.
+     */
     const actions: ToolAction[] = [
         ...(mode === "jwks"
             ? [{ id: "sample", label: t.common.sample, icon: RotateCcw, onClick: () => { setJwks(SAMPLE_INPUT); setToken(SAMPLE_JWT); setSelectedKey("sample-rsa-key"); setOutput(""); setError(null) } } satisfies ToolAction]
             : []),
         { id: "clear", label: t.common.clear, icon: Eraser, onClick: () => { if (mode === "jwks") { setJwks(""); setToken(""); setSelectedKey("") } setOutput(""); setError(null) } },
         { id: "run", label: mode === "pkce" ? toolT.generate_pkce_action : toolT.inspect_jwks_action, icon: Play, onClick: run, variant: "default" },
-        { id: "copy", label: t.common.copy, icon: Copy, onClick: () => void copyOutput(), disabled: !output },
+        { id: "copy", label: t.common.copy, icon: Copy, onClick: copyOutput, disabled: !output },
     ]
 
     return (
diff --git a/tests/component/bf-025-bf-031-image-file-safety.test.tsx b/tests/component/bf-025-bf-031-image-file-safety.test.tsx
index 6e950065..71b13d32 100644
--- a/tests/component/bf-025-bf-031-image-file-safety.test.tsx
+++ b/tests/component/bf-025-bf-031-image-file-safety.test.tsx
@@ -107,7 +107,7 @@ describe("BF-025/BF-031 image file safety", () => {
     it("shows shared limits, rejects invalid files before resize work, and keeps output actions disabled", async () => {
         renderEnglish(<ImageResizerPage />)
 
-        expect(screen.getByText(/Accepted input: image\/\*/)).toBeInTheDocument()
+        expect(screen.getByText(/Accepted input: \.png,\.jpg,\.jpeg,\.webp,\.gif,\.avif/)).toBeInTheDocument()
         expect(screen.getByText(/Max file size: 12 MB/)).toBeInTheDocument()
         expect(screen.getByText(/Max resolution: 24 MP/)).toBeInTheDocument()
 
@@ -120,9 +120,9 @@ describe("BF-025/BF-031 image file safety", () => {
             description: "Run the tool first to create output.",
         })).toBeDisabled()
 
-        loadResizeImageFileMock.mockRejectedValueOnce(new Error("Unsupported file type. Supported input: Image files up to 12 MB and 24 MP."))
+        loadResizeImageFileMock.mockRejectedValueOnce(new Error("Unsupported file type. Supported input: Raster image files up to 12 MB and 24 MP. Use SVG tools for SVG files."))
         fireEvent.change(fileInput(), { target: { files: [new File(["bad"], "payload.exe", { type: "application/octet-stream" })] } })
-        expect(await screen.findByText("Unsupported file type. Supported input: Image files up to 12 MB and 24 MP.")).toBeInTheDocument()
+        expect(await screen.findByText("Unsupported file type. Supported input: Raster image files up to 12 MB and 24 MP. Use SVG tools for SVG files.")).toBeInTheDocument()
         expect(runImageResizeTaskMock).not.toHaveBeenCalled()
 
         loadResizeImageFileMock.mockRejectedValueOnce(new Error("File is too large. Max supported size is 12 MB."))
diff --git a/tests/component/jwt-verifier-page.test.tsx b/tests/component/jwt-verifier-page.test.tsx
index 35e26ff9..98809903 100644
--- a/tests/component/jwt-verifier-page.test.tsx
+++ b/tests/component/jwt-verifier-page.test.tsx
@@ -50,6 +50,10 @@ function unsignedToken(algorithm: string) {
     return `${encodeJsonSegment({ alg: algorithm, typ: "JWT" })}.${encodeJsonSegment({ sub: "alice" })}.signature`
 }
 
+function tokenWithHeader(header: Record<string, unknown>) {
+    return `${encodeJsonSegment(header)}.${encodeJsonSegment({ sub: "alice" })}.signature`
+}
+
 describe("JwtVerifierPage", () => {
     beforeEach(() => {
         vi.clearAllMocks()
@@ -104,4 +108,17 @@ describe("JwtVerifierPage", () => {
             expect(screen.queryByText(/Signature does not match/)).not.toBeInTheDocument()
         })
     })
+
+    it("shows malformed non-string alg as unsupported guidance", async () => {
+        renderJwtVerifier()
+
+        fireEvent.change(screen.getByRole("textbox", { name: "JWT Token" }), { target: { value: tokenWithHeader({ alg: 123, typ: "JWT" }) } })
+        fireEvent.change(screen.getByLabelText("Secret Key (for HMAC verification)"), { target: { value: "ignored" } })
+        fireEvent.click(screen.getByRole("button", { name: "Verify" }))
+
+        await waitFor(() => {
+            expect(screen.getByText(/Unsupported JWT algorithm \(non-string alg\)/)).toBeInTheDocument()
+            expect(screen.queryByText(/Signature does not match/)).not.toBeInTheDocument()
+        })
+    })
 })
diff --git a/tests/component/privacy-page.test.tsx b/tests/component/privacy-page.test.tsx
index ed70ef2e..59a5dfff 100644
--- a/tests/component/privacy-page.test.tsx
+++ b/tests/component/privacy-page.test.tsx
@@ -14,21 +14,29 @@ vi.mock("next/link", () => ({
 
 function installMemoryStorage() {
     const store = new Map<string, string>()
+    const createStorage = (storageStore: Map<string, string>) => ({
+        getItem: (key: string) => (storageStore.has(key) ? storageStore.get(key)! : null),
+        setItem: (key: string, value: string) => {
+            storageStore.set(key, value)
+        },
+        removeItem: (key: string) => {
+            storageStore.delete(key)
+        },
+        clear: () => {
+            storageStore.clear()
+        },
+        key: (index: number) => Array.from(storageStore.keys())[index] ?? null,
+        get length() {
+            return storageStore.size
+        },
+    })
     Object.defineProperty(window, "localStorage", {
         configurable: true,
-        value: {
-            getItem: (key: string) => (store.has(key) ? store.get(key)! : null),
-            setItem: (key: string, value: string) => {
-                store.set(key, value)
-            },
-            removeItem: (key: string) => {
-                store.delete(key)
-            },
-            key: (index: number) => Array.from(store.keys())[index] ?? null,
-            get length() {
-                return store.size
-            },
-        },
+        value: createStorage(store),
+    })
+    Object.defineProperty(window, "sessionStorage", {
+        configurable: true,
+        value: createStorage(new Map<string, string>()),
     })
 }
 
@@ -119,6 +127,29 @@ describe("PrivacyPage", () => {
         expect(screen.getByText("Cleared 1 preference items.")).toBeInTheDocument()
     })
 
+    it("clears all Byteflow data while preserving analytics opt-out and clearing session state", async () => {
+        window.localStorage.setItem("byteflow:analytics:opt-out", "1")
+        window.localStorage.setItem("byteflow:preferred-locale", "en")
+        window.localStorage.setItem("byteflow:tools:favorites", JSON.stringify([{ toolKey: "json-formatter", updatedAt: "2026-01-01T00:00:00.000Z" }]))
+        window.sessionStorage.setItem("byteflow:pwa-install:session-prompted", "1")
+        window.sessionStorage.setItem("third-party:state", "keep")
+
+        render(
+            <LangProvider lang="en" translations={getTranslation("en")}>
+                <PrivacyPage />
+            </LangProvider>,
+        )
+
+        fireEvent.click(screen.getByRole("button", { name: "Clear saved tool data" }))
+
+        await waitFor(() => expect(window.localStorage.getItem("byteflow:preferred-locale")).toBeNull())
+        expect(window.localStorage.getItem("byteflow:tools:favorites")).toBeNull()
+        expect(window.localStorage.getItem("byteflow:analytics:opt-out")).toBe("1")
+        expect(window.sessionStorage.getItem("byteflow:pwa-install:session-prompted")).toBeNull()
+        expect(window.sessionStorage.getItem("third-party:state")).toBe("keep")
+        expect(screen.getByLabelText("Opt out of analytics on this browser")).toBeChecked()
+    })
+
     it("clears only byteflow PWA cache buckets from local data controls", async () => {
         const deleteCache = vi.fn().mockResolvedValue(true)
         Object.defineProperty(window, "caches", {
diff --git a/tests/component/verification-mode-panel.test.tsx b/tests/component/verification-mode-panel.test.tsx
index 1397ea23..dccafb19 100644
--- a/tests/component/verification-mode-panel.test.tsx
+++ b/tests/component/verification-mode-panel.test.tsx
@@ -3,6 +3,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
 import { LangProvider } from "@/core/i18n/lang-provider"
 import { getTranslation } from "@/core/i18n/translations/catalog"
 import { VerificationModePanel } from "@/components/layout/verification-mode-panel"
+import { isAllowedVerificationStorageKey } from "@/core/trust/verification-mode"
 
 vi.mock("next/link", () => ({
     default: ({ href, children, ...props }: { href: string; children: React.ReactNode }) => (
@@ -50,6 +51,7 @@ describe("VerificationModePanel", () => {
         expect(screen.getByText("Browser-local tool")).toBeInTheDocument()
         expect(screen.getByText("0 requests observed")).toBeInTheDocument()
         expect(screen.getByText("External hosts: No external hosts observed")).toBeInTheDocument()
+        expect(screen.getByText(/Scope: fetch, sendBeacon, and storage changes only/)).toBeInTheDocument()
         expect(screen.getByRole("link", { name: "Trust Center verification steps" })).toHaveAttribute(
             "href",
             "/en/trust-center#verify-local-processing",
@@ -81,10 +83,12 @@ describe("VerificationModePanel", () => {
         openPanel()
 
         fireEvent.click(screen.getByRole("button", { name: "Off" }))
-        window.localStorage.setItem("byteflow:test:key", "secret-value")
+        window.localStorage.setItem("byteflow:tools:favorites", "secret-value")
+        window.localStorage.setItem("byteflow:jwt-input", "token-like-value")
         window.sessionStorage.setItem("third-party:key", "another-secret-value")
 
-        await waitFor(() => expect(screen.getByText(/localStorage\.setItem\(byteflow:test:key\) allowed/)).toBeInTheDocument())
+        await waitFor(() => expect(screen.getByText(/localStorage\.setItem\(byteflow:tools:favorites\) allowed/)).toBeInTheDocument())
+        expect(screen.getByText(/localStorage\.setItem\(byteflow:jwt-input\) review/)).toBeInTheDocument()
         expect(screen.getByText(/sessionStorage\.setItem\(third-party:key\) review/)).toBeInTheDocument()
         expect(document.body).not.toHaveTextContent("secret-value")
         expect(document.body).not.toHaveTextContent("another-secret-value")
@@ -95,6 +99,15 @@ describe("VerificationModePanel", () => {
         expect(screen.getByText("No storage changes observed.")).toBeInTheDocument()
     })
 
+    it("allows only reviewed safe storage keys", () => {
+        expect(isAllowedVerificationStorageKey("byteflow:tools:favorites")).toBe(true)
+        expect(isAllowedVerificationStorageKey("byteflow:analytics:opt-out")).toBe(true)
+        expect(isAllowedVerificationStorageKey("theme")).toBe(true)
+        expect(isAllowedVerificationStorageKey("byteflow:payload")).toBe(false)
+        expect(isAllowedVerificationStorageKey("byteflow:jwt-input")).toBe(false)
+        expect(isAllowedVerificationStorageKey("byteflow:unknown-preference")).toBe(false)
+    })
+
     it("does not render on non-tool routes", () => {
         const { container } = renderPanel("/en/trust-center")
 
diff --git a/tests/guards/verification-mode-acceptance.test.ts b/tests/guards/verification-mode-acceptance.test.ts
index f8e7304b..accb8288 100644
--- a/tests/guards/verification-mode-acceptance.test.ts
+++ b/tests/guards/verification-mode-acceptance.test.ts
@@ -16,11 +16,16 @@ describe("verification mode acceptance guard", () => {
         expect(panelSource).toContain("recordNetwork(input, getVerificationRequestMethod(input, init))")
         expect(panelSource).toContain('recordNetwork(url, "BEACON")')
         expect(panelSource).toContain("recordStorage(this, \"setItem\", key)")
+        expect(panelSource).toContain("verification_mode_scope")
         expect(panelSource).not.toContain("raw-secret-body")
         expect(panelSource).not.toContain("Authorization")
         expect(panelSource).not.toContain("headers:")
         expect(panelSource).not.toContain("body:")
         expect(trustSource).toContain("host: url.origin")
+        expect(trustSource).toContain("VERIFICATION_STORAGE_KEY_POLICY")
+        expect(trustSource).toContain('"byteflow:tools:favorites"')
+        expect(trustSource).toContain('"payload"')
+        expect(trustSource).not.toContain('"byteflow:"')
         expect(trustSource).not.toContain("url.search")
         expect(trustSource).not.toContain("url.href")
         expect(trustSource).not.toContain("url.pathname")
diff --git a/tests/unit/csv-json-task-logic.test.ts b/tests/unit/csv-json-task-logic.test.ts
index 82904ab4..281dddce 100644
--- a/tests/unit/csv-json-task-logic.test.ts
+++ b/tests/unit/csv-json-task-logic.test.ts
@@ -79,6 +79,44 @@ describe("csv json task logic", () => {
         expect(result.output).toBe("id,name\n1,Ada")
     })
 
+    it("keeps primitive and array rows on the non-object CSV path", () => {
+        const primitiveResult = runCsvJsonTaskSync({
+            input: "[null,2,\"x\",false]",
+            direction: "json-to-csv",
+            delimiter: ",",
+            hasHeader: true,
+            typeInference: true,
+        })
+        const arrayResult = runCsvJsonTaskSync({
+            input: "[[1,\"Ada\"],[2,\"Grace\"]]",
+            direction: "json-to-csv",
+            delimiter: ",",
+            hasHeader: true,
+            typeInference: true,
+        })
+
+        expect(primitiveResult.output).toBe("null\n2\nx\nfalse")
+        expect(arrayResult.output).toBe("1,Ada\n2,Grace")
+    })
+
+    it("rejects mixed object and non-object rows with actionable row details", () => {
+        expect(() => runCsvJsonTaskSync({
+            input: "[{\"id\":1}, null]",
+            direction: "json-to-csv",
+            delimiter: ",",
+            hasHeader: true,
+            typeInference: true,
+        })).toThrow("JSON array rows must be objects when converting to header-based CSV. Row 2 is null.")
+
+        expect(() => runCsvJsonTaskSync({
+            input: "[null, {\"id\":1}]",
+            direction: "json-to-csv",
+            delimiter: ",",
+            hasHeader: true,
+            typeInference: true,
+        })).toThrow("JSON array rows must be objects when converting to header-based CSV. Row 1 is null.")
+    })
+
     it("serializes nested arrays and objects as JSON cells when converting to CSV", () => {
         const result = runCsvJsonTaskSync({
             input: JSON.stringify([
diff --git a/tests/unit/file-input-policy.test.ts b/tests/unit/file-input-policy.test.ts
index aa072e89..1b69d474 100644
--- a/tests/unit/file-input-policy.test.ts
+++ b/tests/unit/file-input-policy.test.ts
@@ -34,6 +34,25 @@ describe("file-input-policy", () => {
         expect(validateFileAgainstPolicy(new File(["<svg />"], "icon.svg", { type: "" }), FILE_INPUT_POLICIES.svg)).toMatchObject({ ok: true })
     })
 
+    it("keeps raw SVG out of generic raster image policies", () => {
+        for (const policyId of ["image-standard", "image-compact", "image-logo"] as const) {
+            const policy = FILE_INPUT_POLICIES[policyId]
+            expect(policy.accept).not.toContain("image/*")
+            expect(policy.allowedExtensions).not.toContain(".svg")
+            expect(policy.allowedMimeTypes).not.toContain("image/svg+xml")
+            expect(validateFileAgainstPolicy(new File(["<svg />"], "unsafe.svg", { type: "image/svg+xml" }), policy)).toMatchObject({
+                ok: false,
+                reason: "unsupported_type",
+            })
+            expect(validateFileAgainstPolicy(new File(["<svg />"], "unsafe.svg", { type: "image/png" }), policy)).toMatchObject({
+                ok: false,
+                reason: "unsupported_type",
+            })
+        }
+
+        expect(validateFileAgainstPolicy(new File(["<svg />"], "safe.svg", { type: "image/svg+xml" }), FILE_INPUT_POLICIES.svg)).toMatchObject({ ok: true })
+    })
+
     it("reads only files that pass policy validation", async () => {
         await expect(readTextFileWithPolicy(new File(["alpha"], "sample.txt", { type: "text/plain" }))).resolves.toBe("alpha")
         await expect(readArrayBufferWithPolicy(new File([new Uint8Array([1, 2])], "sample.bin"), FILE_INPUT_POLICIES["hash-file"])).resolves.toBeInstanceOf(ArrayBuffer)
diff --git a/tests/unit/jwt-verifier-claims.test.ts b/tests/unit/jwt-verifier-claims.test.ts
index ae864579..3d7897f9 100644
--- a/tests/unit/jwt-verifier-claims.test.ts
+++ b/tests/unit/jwt-verifier-claims.test.ts
@@ -54,6 +54,8 @@ describe("jwt verifier claims", () => {
         expect(classifyJwtVerificationAlgorithm("RS256")).toBe("unsupported")
         expect(classifyJwtVerificationAlgorithm("ES256")).toBe("unsupported")
         expect(classifyJwtVerificationAlgorithm("none")).toBe("unsigned")
+        expect(classifyJwtVerificationAlgorithm(123)).toBe("unsupported")
+        expect(classifyJwtVerificationAlgorithm({ name: "HS256" })).toBe("unsupported")
     })
 
     it("verifies HMAC signatures without treating unsupported algorithms as invalid", async () => {
@@ -65,6 +67,7 @@ describe("jwt verifier claims", () => {
         await expect(verifyJwtSignature(token, "correct", "HS256")).resolves.toEqual({ status: "valid", algorithm: "HS256" })
         await expect(verifyJwtSignature(token, "wrong", "HS256")).resolves.toEqual({ status: "invalid", algorithm: "HS256" })
         await expect(verifyJwtSignature(token, "ignored", "RS256")).resolves.toEqual({ status: "unsupported", algorithm: "RS256" })
+        await expect(verifyJwtSignature(token, "ignored", 123)).resolves.toEqual({ status: "unsupported", algorithm: "non-string alg" })
         await expect(verifyJwtSignature(`${encodeJsonSegment({ alg: "none" })}.${payload}.`, "", "none")).resolves.toEqual({ status: "unsigned", algorithm: "none" })
     })
 })