## Audit the host's Permissions-Policy (screenshots + dictation)

Two widget features run in the page's browsing context and are gated by
the site's own `Permissions-Policy` header: **screenshot capture** needs
`display-capture`, **dictation** needs `microphone`. Security-header
boilerplate (Lighthouse / securityheaders.com templates, framework
starters) commonly ships empty allowlists — `display-capture=(),
microphone=()` — which deny the feature to the page's OWN scripts,
including the widget. The widget detects this at runtime and shows the
reviewer an explanatory error, but the reviewer can't fix a response
header — the developer running THIS install can. Catch it now.

Search the repo for delivered-header config — check whichever of these
exist:

- `_headers` (Cloudflare Pages / static hosts), `public/_headers`
- `netlify.toml` (`[[headers]]`), `vercel.json` (`headers`)
- `next.config.js/mjs/ts` (`headers()`), middleware setting headers
- Worker / server code that sets `Permissions-Policy` (e.g.
  `src/worker.js`, Express/helmet config)
- `nginx*.conf`, `.htaccess`
- `<meta http-equiv="Permissions-Policy">` in layouts (non-standard but
  people try it)

Grep them for `display-capture` and `microphone`:

- **`display-capture=()` or `microphone=()` found** → report the exact
  file and line, then print:

  > Your Permissions-Policy blocks the widget's
  > <screenshots / dictation / screenshots and dictation>:
  > `<file>:<line>` — `<the directive>`. Change `()` to `(self)` so the
  > widget (a same-origin script) can use it. Apply this fix? **[Y/n]**

  - **Y / empty** → make the minimal edit (`display-capture=(self)` /
    `microphone=(self)` — touch nothing else in the header) and stage it
    with this run's install batch (the landing step commits everything
    together).
  - **n / no** → leave it and print: *"Screenshot and/or dictation
    buttons will show 'turned off on this site' until this header is
    relaxed."*

- **A `Permissions-Policy` exists but doesn't mention these features, or
  no header config exists at all** → fine; the browser default allowlist
  for both features is `self`. Say nothing and continue.