diff --git a/Makefile b/Makefile
index 25dab0a..e25d331 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ NOSTR_LIB  = ./nostr_core_lib/libnostr_core_x64.a
 NOSTR_DEPS = -lsecp256k1 -lssl -lcrypto -lcurl -lz -ldl -lpthread -lm
 
 BIN := sovereign_browser
-SRC := src/main.c src/key_store.c src/login_dialog.c src/nostr_bridge.c src/nostr_inject.c src/nostr_url.c src/nostr_scheme.c src/history.c src/settings.c src/net_services.c src/tor_control.c src/tor_scheme.c src/fips_control.c src/tab_manager.c src/session.c src/agent_server.c src/agent_login.c src/agent_snapshot.c src/agent_tools.c src/agent_mcp.c src/cli.c src/qr.c src/db.c src/relay_fetch.c src/bookmarks.c src/shortcuts.c src/settings_sync.c src/search.c src/profile.c src/agent_fs_tools.c src/agent_llm.c src/agent_loop.c src/agent_chat_store.c src/agent_chat.c src/agent_conversations.c src/agent_skills.c src/embedded_web_content.c src/process_info.c src/perf_probe.c src/webkit_data.c src/web_context.c
+SRC := src/main.c src/key_store.c src/login_dialog.c src/nostr_bridge.c src/nostr_inject.c src/nostr_url.c src/nostr_scheme.c src/history.c src/settings.c src/net_services.c src/tor_control.c src/tor_scheme.c src/fips_control.c src/tab_manager.c src/session.c src/agent_server.c src/agent_login.c src/agent_snapshot.c src/agent_tools.c src/agent_mcp.c src/cli.c src/qr.c src/db.c src/relay_fetch.c src/bookmarks.c src/shortcuts.c src/settings_sync.c src/search.c src/profile.c src/agent_fs_tools.c src/agent_llm.c src/agent_loop.c src/agent_chat_store.c src/agent_chat.c src/agent_conversations.c src/agent_skills.c src/embedded_web_content.c src/process_info.c src/perf_probe.c src/webkit_data.c src/web_context.c src/site_downloader.c
 
 # Web files embedded into the binary as C byte arrays.
 WEB_FILES := $(shell find www -type f \( -name '*.html' -o -name '*.css' -o -name '*.js' \) 2>/dev/null)
diff --git a/VERSION b/VERSION
index ea7f030..a758e3a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.0.56
+0.0.57
diff --git a/plans/download-website-offline.md b/plans/download-website-offline.md
new file mode 100644
index 0000000..8d27339
--- /dev/null
+++ b/plans/download-website-offline.md
@@ -0,0 +1,156 @@
+# Plan: Download Website for Offline Viewing
+
+## Goal
+
+Add a "Download Website" option to the tab right-click context menu. It crawls
+the current site (same-origin, bounded by a page cap), saves all pages and
+assets to a per-profile directory, rewrites links to relative paths, and opens
+the offline copy in a new tab via `file://`.
+
+## User decisions
+
+- **Depth:** Entire site — follow all same-origin links, no depth limit, bounded
+  by a max-page-count safety cap (default 500).
+- **Storage:** Per-profile:
+  `~/.sovereign_browser/profiles/<pubkey>/offline_sites/<hostname>/`
+  (falls back to `~/.sovereign_browser/offline_sites/<hostname>/` when not
+  logged in).
+- **Feedback:** Small modal progress dialog with pages/files counts, a progress
+  bar, and a Cancel button.
+
+## Trigger
+
+Right-click on a tab → "Download Website" menu item. Added to **both** tab
+context menus in [`src/tab_manager.c`](../src/tab_manager.c):
+
+- `on_tab_label_button_press` menu (line ~828)
+- `on_notebook_button_press` menu (line ~751)
+
+The callback reads the right-clicked tab's `current_url` and is only active for
+`http://` / `https://` URLs (greyed out / error dialog otherwise).
+
+## Architecture
+
+```mermaid
+flowchart TD
+    A[Right-click tab] --> B[Download Website menu item]
+    B --> C{URL is http/https?}
+    C -- No --> D[Show error, abort]
+    C -- Yes --> E[Show progress dialog]
+    E --> F[Start worker thread BFS crawl]
+    F --> G[Fetch page via libsoup]
+    G --> H[Save HTML to offline_sites/host/path]
+    H --> I[Extract same-origin links + assets]
+    I --> J{Cancel clicked?}
+    J -- Yes --> K[Stop crawl]
+    J -- No --> L{More URLs and under cap?}
+    L -- Yes --> G
+    L -- No --> M[Close dialog]
+    K --> M
+    M --> N[Open file://offline_sites/host/index.html in new tab]
+```
+
+### New files
+
+#### `src/site_downloader.h`
+
+Public API (self-contained, called from the tab context menu):
+
+```c
+/* Start downloading the website at start_url. Shows a modal progress
+ * dialog parented to `parent`. On completion (or cancel) opens the
+ * offline copy in a new tab. No-op for non-http(s) URLs. */
+void site_downloader_start(const char *start_url, GtkWindow *parent);
+```
+
+#### `src/site_downloader.c`
+
+Implementation:
+
+1. **Progress dialog** — `GtkDialog` with:
+   - `GtkLabel` showing hostname + "Pages: N / Files: M"
+   - `GtkProgressBar` (pulse mode; or fraction = pages / cap)
+   - Cancel `GtkButton` → sets `g_atomic_int_set(&cancel, 1)`
+
+2. **Worker thread** — `g_thread_new("site-dl", ...)` running a BFS crawl:
+   - `SoupSession` (libsoup-3.0; pattern from
+     [`src/agent_llm.c`](../src/agent_llm.c:285) and
+     [`src/search.c`](../src/search.c:158)).
+   - Queue (GQueue) of URLs to fetch + a `GHashTable` visited-set.
+   - Politeness delay between requests (default 100ms).
+
+3. **Fetch + save** — for each URL:
+   - `soup_session_send_and_read()` (sync; we're on a worker thread).
+   - Map URL → local path: mirror the URL path under the site root;
+     directory-style URLs → `index.html`; sanitize illegal filename chars.
+   - Write bytes to disk (`g_file_set_contents` for text, manual write for
+     binary).
+   - For HTML responses: extract links, rewrite them to relative paths, then
+     save the rewritten HTML.
+
+4. **Link extraction & rewriting** (no HTML parser dep in the project, so use
+   regex over `href=`, `src=`, `srcset=`, `poster=`, and CSS `url(...)`):
+   - Resolve each link against the page URL (`g_uri_resolve_relative`).
+   - **Same-origin filter:** keep only links whose host matches the start
+     URL's host (via `g_uri_parse`, pattern from
+     [`src/tor_scheme.c`](../src/tor_scheme.c:74)). Enqueue same-origin HTML
+     pages; download all assets (CSS/JS/images/fonts/etc.) regardless of
+     origin but don't crawl cross-origin pages.
+   - Rewrite kept links to relative file paths so the offline copy works from
+     `file://`.
+
+5. **Completion** — `g_idle_add` a callback on the main thread that:
+   - Destroys the progress dialog.
+   - Opens `file://<offline_dir>/index.html` in a new tab via
+     `tab_manager_new_tab()`.
+
+### Modified files
+
+- [`src/tab_manager.c`](../src/tab_manager.c) — add "Download Website" item to
+  both context menus; new callback `on_tab_download_website` calling
+  `site_downloader_start(tab->current_url, g_window)`.
+- [`Makefile`](../Makefile) — add `src/site_downloader.c` to `SRC`.
+- [`src/settings.h`](../src/settings.h) / [`src/settings.c`](../src/settings.c)
+  — add to `browser_settings_t`:
+  - `offline_site_max_pages` (default 500)
+  - `offline_site_request_delay_ms` (default 100)
+  - load/save in `settings_load()` / `settings_save()`.
+
+## Edge cases
+
+- Non-http(s) URLs → menu item shows an error dialog, no crawl.
+- Not logged in → fall back to global `~/.sovereign_browser/offline_sites/`.
+- Redirects → follow libsoup redirects; use the final URL for same-origin
+  checks and path mapping.
+- Binary assets → write raw bytes, never parse/rewrite.
+- Duplicate URLs → visited-set prevents re-fetching.
+- Very large sites → max-page cap stops the crawl; dialog shows "cap reached".
+- Filename sanitization → replace illegal chars (`/`, `?`, `:`, etc.) with `_`.
+- Cancel → worker checks the cancel flag between requests; partial downloads
+  are kept and the new tab opens to whatever was fetched.
+
+## Implementation order
+
+1. Add settings fields + load/save.
+2. Create `site_downloader.h` / `site_downloader.c` skeleton: progress dialog
+   + thread stub + completion callback.
+3. Implement libsoup fetch + file write + URL→path mapping.
+4. Implement HTML link extraction, same-origin filter, link rewriting.
+5. Implement BFS crawl loop: visited-set, cap, cancel flag, progress updates.
+6. Implement completion callback: open new tab with `file://` URL.
+7. Wire "Download Website" into both tab context menus in `tab_manager.c`.
+8. Add `site_downloader.c` to `Makefile`.
+9. Build (`make`) and test with `tests/local-site/` served via
+   `python3 -m http.server`.
+
+## Testing
+
+- Serve `tests/local-site/` with `python3 -m http.server 8000` from the
+  `tests/` directory.
+- Open `http://localhost:8000/local-site/index.html` in the browser.
+- Right-click the tab → Download Website.
+- Verify the progress dialog appears, files are saved under
+  `~/.sovereign_browser/profiles/<pubkey>/offline_sites/localhost/`, and a new
+  tab opens the offline `index.html` with working relative links and assets.
+- Test Cancel mid-download.
+- Test a non-http URL (e.g. `sovereign://profile`) → error dialog.
diff --git a/src/cli.c b/src/cli.c
index d96c26d..b186842 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -109,6 +109,7 @@ enum {
     OPT_VERBOSE,
     OPT_QUIET,
     OPT_HELP,
+    OPT_DOWNLOAD_URL,
 };
 
 static struct option long_opts[] = {
@@ -143,6 +144,7 @@ static struct option long_opts[] = {
     {"verbose",            no_argument,       0, OPT_VERBOSE},
     {"quiet",              no_argument,       0, OPT_QUIET},
     {"help",               no_argument,       0, OPT_HELP},
+    {"download-url",       required_argument, 0, OPT_DOWNLOAD_URL},
     {0, 0, 0, 0}
 };
 
@@ -198,6 +200,7 @@ void cli_args_free(cli_args_t *args) {
     g_free(args->nsigner_transport);
     g_free(args->nsigner_device);
     g_free(args->nsigner_service);
+    g_free(args->download_url);
     memset(args, 0, sizeof(*args));
 }
 
@@ -356,6 +359,11 @@ int cli_parse(int *argc, char ***argv, cli_args_t *out) {
             out->want_help = TRUE;
             return 0;
 
+        case OPT_DOWNLOAD_URL:
+            g_free(out->download_url);
+            out->download_url = xstrdup(optarg);
+            break;
+
         default:
             fprintf(stderr, "[cli] unhandled option\n");
             return -1;
diff --git a/src/cli.h b/src/cli.h
index 69397c4..e46ece7 100644
--- a/src/cli.h
+++ b/src/cli.h
@@ -68,6 +68,10 @@ typedef struct {
     int      verbose;              /* --verbose / -v (repeatable count) */
     gboolean quiet;                /* --quiet / -q */
 
+    /* Offline site download (test/diagnostic hook — triggers
+     * site_downloader_start shortly after startup). */
+    char    *download_url;         /* --download-url <url> */
+
     /* Exit-request flags set by --help / --version. */
     gboolean want_help;
     gboolean want_version;
diff --git a/src/main.c b/src/main.c
index ab0c1ed..fc08f11 100644
--- a/src/main.c
+++ b/src/main.c
@@ -48,6 +48,7 @@
 #include "agent_server.h"
 #include "agent_login.h"
 #include "cli.h"
+#include "site_downloader.h"
 #include "db.h"
 #include "profile.h"
 #include "relay_fetch.h"
@@ -163,6 +164,18 @@ const char *app_get_pubkey_hex(void) { return g_state.pubkey_hex; }
 key_store_method_t app_get_method(void) { return g_state.method; }
 gboolean app_get_readonly(void) { return g_state.readonly; }
 
+/* Idle callback for the --download-url diagnostic flag: triggers the
+ * offline site downloader on the main thread shortly after startup. */
+static gboolean dl_test_trigger(gpointer data) {
+    const char *url = (const char *)data;
+    GtkWindow *win = gtk_window_get_focus(GTK_WINDOW(g_window)) ?
+                     g_window : NULL;
+    /* g_window may not be set yet in some early-trigger scenarios; fall
+     * back to NULL (unparented dialog). */
+    site_downloader_start(url, win);
+    return G_SOURCE_REMOVE;
+}
+
 /* ---- Menu proxy functions ------------------------------------------- *
  * These wrap the app_state_t-aware callbacks so they match GTK signal
  * handler signatures and can be called from tab_manager.c's hamburger
@@ -1234,6 +1247,15 @@ int main(int argc, char **argv) {
         }
     }
 
+    /* Diagnostic/test hook: --download-url triggers the offline site
+     * downloader shortly after startup (same code path as the tab
+     * context menu's "Download Website"). */
+    if (cli.download_url != NULL && cli.download_url[0] != '\0') {
+        char *dl_url = g_strdup(cli.download_url);
+        g_idle_add_full(G_PRIORITY_DEFAULT_IDLE,
+            (GSourceFunc)dl_test_trigger, dl_url, g_free);
+    }
+
     cli_args_free(&cli);
 
     gtk_widget_show_all(window);
diff --git a/src/settings.c b/src/settings.c
index 8a686fd..7468266 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -126,6 +126,9 @@ static void settings_set_defaults(browser_settings_t *s) {
     s->fips_control_socket[0] = '\0';
     snprintf(s->fips_config_dir, sizeof(s->fips_config_dir),
              "~/.sovereign_browser/fips");
+
+    s->offline_site_max_pages        = SETTINGS_OFFLINE_SITE_MAX_PAGES_DEFAULT;
+    s->offline_site_request_delay_ms = SETTINGS_OFFLINE_SITE_REQUEST_DELAY_MS_DEFAULT;
 }
 
 /* ── Parsing helpers ──────────────────────────────────────────────── */
@@ -317,6 +320,17 @@ void settings_load_user(void) {
     val = db_kv_get("fips.config_dir");
     if (val) snprintf(g_settings.fips_config_dir, sizeof(g_settings.fips_config_dir), "%s", val);
 
+    val = db_kv_get("offline_site.max_pages");
+    if (val) {
+        g_settings.offline_site_max_pages = parse_int(val, g_settings.offline_site_max_pages);
+        if (g_settings.offline_site_max_pages < 1) g_settings.offline_site_max_pages = 1;
+    }
+    val = db_kv_get("offline_site.request_delay_ms");
+    if (val) {
+        g_settings.offline_site_request_delay_ms = parse_int(val, g_settings.offline_site_request_delay_ms);
+        if (g_settings.offline_site_request_delay_ms < 0) g_settings.offline_site_request_delay_ms = 0;
+    }
+
     /* Agent LLM provider settings — these are the "resolved" values
      * (active provider's base_url + api_key + selected model). They are
      * populated from db_kv here for local persistence, and overwritten
@@ -483,6 +497,11 @@ void settings_save_user(void) {
     db_kv_set("fips.control_socket", g_settings.fips_control_socket);
     db_kv_set("fips.config_dir", g_settings.fips_config_dir);
 
+    snprintf(buf, sizeof(buf), "%d", g_settings.offline_site_max_pages);
+    db_kv_set("offline_site.max_pages", buf);
+    snprintf(buf, sizeof(buf), "%d", g_settings.offline_site_request_delay_ms);
+    db_kv_set("offline_site.request_delay_ms", buf);
+
     /* Agent LLM provider settings — resolved values (active provider). */
     db_kv_set("agent.llm_base_url", g_settings.agent_llm_base_url);
     db_kv_set("agent.llm_api_key", g_settings.agent_llm_api_key);
diff --git a/src/settings.h b/src/settings.h
index 749b9c5..44053a9 100644
--- a/src/settings.h
+++ b/src/settings.h
@@ -34,6 +34,8 @@ extern "C" {
 #define SETTINGS_AGENT_LLM_BASE_URL_DEFAULT "https://api.ppq.ai"
 #define SETTINGS_AGENT_LLM_MODEL_DEFAULT    "gpt-4o"
 #define SETTINGS_AGENT_MAX_ITERATIONS_DEFAULT 100
+#define SETTINGS_OFFLINE_SITE_MAX_PAGES_DEFAULT       500
+#define SETTINGS_OFFLINE_SITE_REQUEST_DELAY_MS_DEFAULT 100
 #define SETTINGS_AGENT_SYSTEM_PROMPT_DEFAULT \
     "You are an AI assistant embedded in a web browser. You have access to browser automation tools (navigate, snapshot, click, fill, etc.) and system tools (filesystem read/write, shell command execution). Use the snapshot tool to understand page content, then interact with elements using refs (e.g. @e1). You can read and write files and run shell commands. Be concise in your responses. When a task is complete, summarize what you did."
 
@@ -121,6 +123,10 @@ typedef struct {
     char     fips_binary_path[256];
     char     fips_control_socket[512];
     char     fips_config_dir[512];
+
+    /* Offline website downloader (right-click tab → Download Website). */
+    int      offline_site_max_pages;        /* safety cap on pages crawled */
+    int      offline_site_request_delay_ms; /* politeness delay between requests */
 } browser_settings_t;
 
 /*
diff --git a/src/site_downloader.c b/src/site_downloader.c
new file mode 100644
index 0000000..45f16e2
--- /dev/null
+++ b/src/site_downloader.c
@@ -0,0 +1,1550 @@
+/*
+ * site_downloader.c — download a website for offline viewing
+ *
+ * See site_downloader.h and plans/download-website-offline.md.
+ *
+ * Architecture:
+ *   - site_downloader_start() is called from the tab context menu on the
+ *     GTK main thread. It validates the URL, builds a progress dialog,
+ *     and spawns a worker thread that runs a BFS crawl.
+ *   - The worker thread uses libsoup-3.0 (synchronous) to fetch each
+ *     page, saves it to disk, extracts same-origin links + assets,
+ *     rewrites links in saved HTML to relative paths, and enqueues new
+ *     pages. It periodically posts progress updates back to the main
+ *     thread via g_idle_add.
+ *   - On completion (or cancel), a main-thread idle callback closes the
+ *     progress dialog and opens the offline index.html in a new tab.
+ */
+
+#include "site_downloader.h"
+#include "settings.h"
+#include "profile.h"
+#include "tab_manager.h"
+#include "web_context.h"
+
+#include <gtk/gtk.h>
+#include <webkit2/webkit2.h>
+#include <libsoup/soup.h>
+#include <glib.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include "../nostr_core_lib/cjson/cJSON.h"
+
+/* Provided by main.c — the currently logged-in user's hex pubkey, or
+ * an empty string when not logged in. */
+extern const char *app_get_pubkey_hex(void);
+
+/* ── Defaults / limits ──────────────────────────────────────────────── */
+
+#define DL_MAX_ASSETS       4000   /* safety cap on total assets fetched   */
+#define DL_MAX_URL_LEN      4096
+#define DL_MAX_PATH_LEN     4096
+#define DL_PROGRESS_UPDATE_MS  150  /* min interval between UI updates (ms) */
+
+/* ── Worker state ───────────────────────────────────────────────────── */
+
+typedef struct {
+    char    *start_url;        /* absolute starting URL (normalized)       */
+    char    *root_dir;         /* on-disk root for this site (no trailing /) */
+    char    *host;             /* same-origin host to restrict crawl to    */
+    char    *path_prefix;      /* path prefix to restrict page crawling to  */
+    SoupSession *session;
+
+    GQueue  *queue;            /* URLs to fetch (char*)                    */
+    GHashTable *visited;       /* set of absolute URL strings              */
+
+    volatile gint cancel;      /* 1 when user clicked Cancel               */
+    volatile gint pages;       /* pages fetched so far                     */
+    volatile gint files;       /* total files (pages + assets) saved       */
+    volatile gint failed;      /* fetch failures                            */
+
+    GtkWindow *parent;         /* for the progress dialog (main thread)    */
+    GtkWidget *dialog;         /* progress dialog (main thread only)       */
+    GtkWidget *status_label;   /* "Pages: N  Files: M"                     */
+    GtkWidget *progress_bar;   /* fraction = pages / cap                    */
+    GtkWidget *host_label;     /* shows the hostname                        */
+
+    gint64  last_ui_update_ms; /* last time we posted an idle update        */
+} dl_state_t;
+
+/* ── Forward declarations ───────────────────────────────────────────── */
+
+static gpointer dl_worker(dl_state_t *st);
+static void     dl_post_progress(dl_state_t *st);
+static gboolean dl_open_result_tab(gpointer data);
+
+/* Global pointer to the active download state, so the completion
+ * callback can find it. Only one download is active at a time. */
+static dl_state_t *g_active_dl = NULL;
+
+/* ── WebKit-based rendered-link extraction ──────────────────────────── *
+ * For SPA pages where links are generated by JavaScript, we load the
+ * page in a hidden WebKit webview, let JS render, then extract all
+ * <a href>, <img src>, <link href>, <script src>, <source src>,
+ * <video src/poster>, <audio src> URLs from the rendered DOM. We also
+ * rewrite the rendered DOM's links to relative paths and save that as
+ * the offline HTML (so the offline copy has working JS-generated links).
+ *
+ * The worker thread sends a render request to the main thread via an
+ * idle callback, then blocks on a condition variable until the main
+ * thread finishes rendering and returns the extracted link list.
+ */
+
+typedef struct {
+    char       *url;         /* URL to render (the worker passes this)     */
+    dl_state_t *st;          /* the download state                         */
+    GPtrArray  *links;       /* result: list of absolute URL strings       */
+    char       *rendered_html; /* result: rewritten rendered HTML, or NULL */
+    gboolean    done;        /* set by main thread when render completes   */
+    GMutex      mutex;
+    GCond       cond;
+} render_req_t;
+
+static WebKitWebView *g_render_webview = NULL;
+
+/* Create the hidden render webview (main thread only). Uses the shared
+ * per-user web context so sovereign://, file://, etc. all work. */
+static WebKitWebView *dl_get_render_webview(void) {
+    if (g_render_webview != NULL) return g_render_webview;
+    WebKitWebContext *ctx = web_context_get();
+    if (ctx == NULL) ctx = webkit_web_context_get_default();
+    g_render_webview = WEBKIT_WEB_VIEW(webkit_web_view_new_with_context(ctx));
+    /* The webview must be realized for loads to work, but we never show
+     * it. Pack it into an offscreen toplevel. */
+    GtkWidget *offscreen = gtk_offscreen_window_new();
+    gtk_container_add(GTK_CONTAINER(offscreen), GTK_WIDGET(g_render_webview));
+    gtk_widget_show_all(offscreen);
+    return g_render_webview;
+}
+
+/* JS script to extract all link/asset URLs from the rendered DOM and
+ * rewrite them to relative paths. Returns a JSON string with:
+ *   { links: ["abs_url", ...], html: "<rewritten html>" }
+ * The rewriting is done in JS by walking the DOM and replacing
+ * href/src attributes with relative paths computed from the page URL. */
+static const char *DL_RENDER_JS =
+    "(function() {"
+    "  var pageUrl = window.location.href;"
+    "  var links = [];"
+    "  function resolve(ref) {"
+    "    try { return new URL(ref, pageUrl).href; } catch(e) { return null; }"
+    "  }"
+    "  function isSameOrigin(u) {"
+    "    try { return new URL(u).origin === new URL(pageUrl).origin; }"
+    "    catch(e) { return false; }"
+    "  }"
+    "  var pathPrefix = DL_PATH_PREFIX_PLACEHOLDER;"
+    "  function underPrefix(u) {"
+    "    try { return new URL(u).pathname.indexOf(pathPrefix) === 0; }"
+    "    catch(e) { return false; }"
+    "  }"
+    "  function relpath(from, to) {"
+    "    var f = from.split('/').slice(0,-1);"
+    "    var t = to.split('/');"
+    "    var i = 0;"
+    "    while (i < f.length && i < t.length && f[i] === t[i]) i++;"
+    "    var up = f.length - i;"
+    "    var rem = t.slice(i).join('/');"
+    "    var r = '';"
+    "    for (var j = 0; j < up; j++) r += '../';"
+    "    r += rem;"
+    "    return r || '.';"
+    "  }"
+    "  function isDir(p) {"
+    "    var base = p.split('/').pop();"
+    "    return p === '' || p.endsWith('/') || !base.includes('.');"
+    "  }"
+    "  function toFilePath(p) {"
+    "    if (isDir(p)) {"
+    "      if (p.endsWith('/')) return p + 'index.html';"
+    "      return p + '/index.html';"
+    "    }"
+    "    return p;"
+    "  }"
+    "  function handle(el, attr, isAsset) {"
+    "    var v = el.getAttribute(attr);"
+    "    if (!v) return;"
+    "    if (/^(javascript:|mailto:|tel:|data:|#)/i.test(v)) return;"
+    "    var abs = resolve(v);"
+    "    if (!abs) return;"
+    "    if (!isSameOrigin(abs)) return;"
+    "    var nofrag = abs.split('#')[0];"
+    "    /* For pages (non-asset), only rewrite and collect if under the"
+    "     * path prefix. Links outside the prefix are left as absolute"
+    "     * URLs so they still work online. Assets are always collected. */"
+    "    if (!isAsset && !underPrefix(nofrag)) return;"
+    "    links.push(nofrag);"
+    "    /* Compute relative path from page to target. Both are root-"
+    "     * relative under the site root. */"
+    "    var pagePath = new URL(pageUrl).pathname.replace(/^\\//, '');"
+    "    var tgtPath = new URL(nofrag).pathname.replace(/^\\//, '');"
+    "    /* If directory-style (no file extension), append index.html. */"
+    "    pagePath = toFilePath(pagePath);"
+    "    tgtPath = toFilePath(tgtPath);"
+    "    var rel = relpath(pagePath, tgtPath);"
+    "    el.setAttribute(attr, rel);"
+    "  }"
+    "  document.querySelectorAll('a[href]').forEach(function(el){ handle(el,'href',false); });"
+    "  document.querySelectorAll('img[src]').forEach(function(el){ handle(el,'src',true); });"
+    "  document.querySelectorAll('link[href]').forEach(function(el){ handle(el,'href',true); });"
+    "  document.querySelectorAll('script[src]').forEach(function(el){ handle(el,'src',true); });"
+    "  document.querySelectorAll('source[src]').forEach(function(el){ handle(el,'src',true); });"
+    "  document.querySelectorAll('video[src]').forEach(function(el){ handle(el,'src',true); });"
+    "  document.querySelectorAll('video[poster]').forEach(function(el){ handle(el,'poster',true); });"
+    "  document.querySelectorAll('audio[src]').forEach(function(el){ handle(el,'src',true); });"
+    "  /* Handle srcset on img/source. */"
+    "  document.querySelectorAll('img[srcset],source[srcset]').forEach(function(el){"
+    "    var ss = el.getAttribute('srcset');"
+    "    if (!ss) return;"
+    "    var parts = ss.split(',').map(function(s){return s.trim();});"
+    "    var out = parts.map(function(p){"
+    "      var sp = p.split(' ');"
+    "      var u = sp[0]; var d = sp.slice(1).join(' ');"
+    "      var abs = resolve(u);"
+    "      if (abs && isSameOrigin(abs)) {"
+    "        links.push(abs.split('#')[0]);"
+    "        var tp = new URL(abs.split('#')[0]).pathname.replace(/^\\//,'');"
+    "        tp = toFilePath(tp);"
+    "        var pp = new URL(pageUrl).pathname.replace(/^\\//,'');"
+    "        pp = toFilePath(pp);"
+    "        return relpath(pp, tp) + (d ? ' ' + d : '');"
+    "      }"
+    "      return p;"
+    "    });"
+    "    el.setAttribute('srcset', out.join(', '));"
+    "  });"
+    "  /* Handle inline style url() and CSS. */"
+    "  var html = '<!DOCTYPE html>\\n' + document.documentElement.outerHTML;"
+    "  return JSON.stringify({ links: links, html: html });"
+    "})()";
+
+/* JS evaluation callback for the render webview. */
+typedef struct {
+    render_req_t *req;
+    gboolean      done;
+    char         *result;
+} render_js_ctx_t;
+
+static void on_render_js_finished(GObject *source, GAsyncResult *res,
+                                   gpointer user_data) {
+    render_js_ctx_t *jctx = (render_js_ctx_t *)user_data;
+    WebKitWebView *wv = WEBKIT_WEB_VIEW(source);
+    GError *js_err = NULL;
+    JSCValue *value = webkit_web_view_evaluate_javascript_finish(wv, res, &js_err);
+    if (js_err) {
+        g_printerr("[site-dl] JS eval error: %s\n", js_err->message);
+        g_error_free(js_err);
+    }
+    if (value) {
+        char *s = jsc_value_to_string(value);
+        if (s) { jctx->result = g_strdup(s); free(s); }
+        g_object_unref(value);
+    } else {
+        g_printerr("[site-dl] JS eval returned NULL value\n");
+    }
+    jctx->done = TRUE;
+}
+
+/* Load-changed callback for the render webview. When the page finishes
+ * loading, we wait a short delay for JS to render, then run the link
+ * extraction script. */
+typedef struct {
+    render_req_t *req;
+    guint         settle_id;
+} render_load_ctx_t;
+
+static gboolean on_render_settle(gpointer data) {
+    render_load_ctx_t *lctx = (render_load_ctx_t *)data;
+    render_req_t *req = lctx->req;
+    WebKitWebView *wv = dl_get_render_webview();
+    /* Run the link extraction JS, wrapped in try/catch for debugging.
+     * Substitute the path prefix placeholder with the actual prefix. */
+    render_js_ctx_t jctx = { .req = req, .done = FALSE, .result = NULL };
+
+    /* Build the inner JS with the path prefix substituted. The prefix
+     * is a URL path (letters, digits, /, -, _, .) so no JS escaping is
+     * needed. */
+    const char *prefix = (req->st && req->st->path_prefix) ?
+                          req->st->path_prefix : "/";
+    char *prefix_js = g_strdup_printf("'%s'", prefix);
+
+    /* Replace the placeholder in DL_RENDER_JS with the prefix JS string. */
+    const char *placeholder = strstr(DL_RENDER_JS, "DL_PATH_PREFIX_PLACEHOLDER");
+    char *inner_js;
+    if (placeholder) {
+        GString *jsb = g_string_new("");
+        g_string_append_len(jsb, DL_RENDER_JS,
+                            (gsize)(placeholder - DL_RENDER_JS));
+        g_string_append(jsb, prefix_js);
+        g_string_append(jsb, placeholder + strlen("DL_PATH_PREFIX_PLACEHOLDER"));
+        inner_js = g_string_free(jsb, FALSE);
+    } else {
+        inner_js = g_strdup(DL_RENDER_JS);
+    }
+    g_free(prefix_js);
+
+    char *full_js = g_strdup_printf(
+        "(function(){ try { var r = %s; return r; } catch(e) { return 'ERROR: ' + e.message; } })()",
+        inner_js);
+    g_free(inner_js);
+    webkit_web_view_evaluate_javascript(wv, full_js, -1, NULL, NULL, NULL,
+                                         on_render_js_finished, &jctx);
+    g_free(full_js);
+
+    /* We can't use a nested main loop here easily because we're already
+     * in the main loop. Use a short polling approach with a timeout. */
+    gint64 deadline = g_get_monotonic_time() + 10 * G_TIME_SPAN_SECOND;
+    while (!jctx.done && g_get_monotonic_time() < deadline) {
+        g_main_context_iteration(g_main_context_default(), TRUE);
+    }
+
+    if (jctx.result) {
+        /* Parse the JSON result with cJSON. */
+        cJSON *root = cJSON_Parse(jctx.result);
+        if (root) {
+            cJSON *links = cJSON_GetObjectItem(root, "links");
+            if (links && cJSON_IsArray(links)) {
+                cJSON *item;
+                cJSON_ArrayForEach(item, links) {
+                    if (cJSON_IsString(item) && item->valuestring) {
+                        g_ptr_array_add(req->links, g_strdup(item->valuestring));
+                    }
+                }
+            }
+            cJSON *html = cJSON_GetObjectItem(root, "html");
+            if (html && cJSON_IsString(html) && html->valuestring) {
+                req->rendered_html = g_strdup(html->valuestring);
+            }
+            cJSON_Delete(root);
+        }
+        g_free(jctx.result);
+    }
+
+    /* Signal the worker thread that we're done. */
+    g_mutex_lock(&req->mutex);
+    req->done = TRUE;
+    g_cond_signal(&req->cond);
+    g_mutex_unlock(&req->mutex);
+
+    g_free(lctx);
+    return G_SOURCE_REMOVE;
+}
+
+static void on_render_load_changed(WebKitWebView *wv,
+                                    WebKitLoadEvent load_event,
+                                    gpointer user_data) {
+    render_load_ctx_t *lctx = (render_load_ctx_t *)user_data;
+    if (load_event == WEBKIT_LOAD_FINISHED) {
+        /* Wait a bit for JS frameworks to render the DOM. */
+        if (lctx->settle_id) g_source_remove(lctx->settle_id);
+        lctx->settle_id = g_timeout_add(2000, on_render_settle, lctx);
+    }
+}
+
+/* Main-thread idle callback to process a render request. */
+static gboolean dl_process_render_req(gpointer data) {
+    render_req_t *req = (render_req_t *)data;
+    WebKitWebView *wv = dl_get_render_webview();
+
+    render_load_ctx_t *lctx = g_new0(render_load_ctx_t, 1);
+    lctx->req = req;
+    lctx->settle_id = 0;
+
+    /* Connect a one-shot load-changed handler. We store the handler id
+     * on the webview so we can disconnect after the render completes. */
+    gulong handler = g_signal_connect(wv, "load-changed",
+                                       G_CALLBACK(on_render_load_changed), lctx);
+    g_object_set_data_full(G_OBJECT(wv), "render-lctx", lctx,
+                           (GDestroyNotify)g_free);
+
+    /* Load the page. */
+    webkit_web_view_load_uri(wv, req->url);
+
+    /* Store the handler id as a heap-allocated gulong so we can
+     * disconnect it when the render completes. */
+    gulong *hp = g_new(gulong, 1);
+    *hp = handler;
+    g_object_set_data_full(G_OBJECT(wv), "render-handler", hp, g_free);
+
+    return G_SOURCE_REMOVE;
+}
+
+/* Worker thread: request the main thread to render a page and extract
+ * its rendered links. Blocks until the render completes (or timeout).
+ * Returns a newly-allocated GPtrArray of absolute URL strings (caller
+ * frees array + elements) and sets *out_html to the rewritten rendered
+ * HTML (caller frees, may be NULL). */
+static GPtrArray *dl_render_page(dl_state_t *st, const char *url,
+                                  char **out_html) {
+    *out_html = NULL;
+
+    render_req_t req = {0};
+    req.url = (char *)url;
+    req.st = st;
+    req.links = g_ptr_array_new_with_free_func(g_free);
+    req.rendered_html = NULL;
+    req.done = FALSE;
+    g_mutex_init(&req.mutex);
+    g_cond_init(&req.cond);
+
+    /* Send the request to the main thread. */
+    g_idle_add(dl_process_render_req, &req);
+
+    /* Wait for the main thread to finish (with a 30s timeout). */
+    gint64 deadline = g_get_monotonic_time() + 30 * G_TIME_SPAN_SECOND;
+    g_mutex_lock(&req.mutex);
+    while (!req.done && g_get_monotonic_time() < deadline) {
+        g_cond_wait_until(&req.cond, &req.mutex, deadline);
+    }
+    g_mutex_unlock(&req.mutex);
+
+    g_mutex_clear(&req.mutex);
+    g_cond_clear(&req.cond);
+
+    /* Disconnect the load-changed handler if still connected. */
+    WebKitWebView *wv = g_render_webview;
+    if (wv) {
+        gulong *hp = (gulong *)g_object_steal_data(G_OBJECT(wv), "render-handler");
+        if (hp) {
+            g_signal_handler_disconnect(wv, *hp);
+            g_free(hp);
+        }
+        g_object_steal_data(G_OBJECT(wv), "render-lctx");
+    }
+
+    *out_html = req.rendered_html;
+    return req.links;
+}
+
+/* ── Path / URL helpers ─────────────────────────────────────────────── */
+
+/* mkdir -p. Returns 0 on success, -1 on error. */
+static int mkdir_p(const char *path, mode_t mode) {
+    char tmp[DL_MAX_PATH_LEN];
+    int n = snprintf(tmp, sizeof(tmp), "%s", path);
+    if (n < 0 || (size_t)n >= sizeof(tmp)) return -1;
+    size_t len = strlen(tmp);
+    if (len > 0 && tmp[len - 1] == '/') tmp[len - 1] = '\0';
+    for (char *p = tmp + 1; *p; p++) {
+        if (*p == '/') {
+            *p = '\0';
+            if (mkdir(tmp, mode) != 0 && errno != EEXIST) return -1;
+            *p = '/';
+        }
+    }
+    if (mkdir(tmp, mode) != 0 && errno != EEXIST) return -1;
+    return 0;
+}
+
+/* Ensure the parent directory of `file_path` exists. */
+static int ensure_parent_dir(const char *file_path) {
+    char *copy = g_strdup(file_path);
+    char *slash = strrchr(copy, '/');
+    if (slash) {
+        *slash = '\0';
+        if (copy[0] != '\0') {
+            if (mkdir_p(copy, 0755) != 0) {
+                g_free(copy);
+                return -1;
+            }
+        }
+    }
+    g_free(copy);
+    return 0;
+}
+
+/* Sanitize a single path segment: replace characters that are illegal
+ * or awkward on the filesystem with '_'. Operates in place. */
+static void sanitize_segment(char *s) {
+    for (; *s; s++) {
+        unsigned char c = (unsigned char)*s;
+        if (c == '/' || c == '\\' || c == ':' || c == '*' || c == '?' ||
+            c == '"' || c == '<' || c == '>' || c == '|' || c == '\0' ||
+            c < 0x20) {
+            *s = '_';
+        }
+    }
+}
+
+/* Map an absolute URL (same-origin) to a relative file path under the
+ * site root. Directory-style URLs (ending in / or with no extension
+ * that looks like a file) map to "<path>/index.html". Query strings and
+ * fragments are dropped. Returns a newly-allocated relative path
+ * (forward slashes, no leading slash). Caller frees. */
+static char *url_to_relpath(const char *abs_url) {
+    GError *err = NULL;
+    GUri *uri = g_uri_parse(abs_url, G_URI_FLAGS_PARSE_RELAXED, &err);
+    if (!uri) {
+        if (err) g_error_free(err);
+        return g_strdup("index.html");
+    }
+
+    const char *path = g_uri_get_path(uri);
+    if (path == NULL || path[0] == '\0') path = "/";
+
+    /* Copy the path, skipping the leading '/'. */
+    const char *p = (path[0] == '/') ? path + 1 : path;
+
+    /* Determine whether this looks like a file (has an extension) or a
+     * directory. If the path ends with '/' or has no '.', treat as a
+     * directory and append index.html. */
+    gboolean is_dir = FALSE;
+    size_t plen = strlen(p);
+    if (plen == 0 || p[plen - 1] == '/') {
+        is_dir = TRUE;
+    } else {
+        const char *last_slash = strrchr(p, '/');
+        const char *base = last_slash ? last_slash + 1 : p;
+        const char *dot = strrchr(base, '.');
+        if (dot == NULL) is_dir = TRUE;
+    }
+
+    char *rel;
+    if (is_dir) {
+        if (plen == 0 || p[plen - 1] == '/') {
+            rel = g_strdup_printf("%sindex.html", p);
+        } else {
+            rel = g_strdup_printf("%s/index.html", p);
+        }
+    } else {
+        rel = g_strdup(p);
+    }
+
+    g_uri_unref(uri);
+
+    /* Sanitize each segment. */
+    char *seg = rel;
+    while (*seg) {
+        char *next = strchr(seg, '/');
+        if (next) {
+            *next = '\0';
+            sanitize_segment(seg);
+            *next = '/';
+            seg = next + 1;
+        } else {
+            sanitize_segment(seg);
+            break;
+        }
+    }
+    return rel;
+}
+
+/* Build the absolute on-disk path for a relative path under root_dir. */
+static char *disk_path(const char *root_dir, const char *rel) {
+    return g_build_filename(root_dir, rel, NULL);
+}
+
+/* Resolve a possibly-relative URL against a base, returning a newly-
+ * allocated absolute URL string. Returns NULL on failure. */
+static char *resolve_url(const char *base, const char *ref) {
+    if (!ref || ref[0] == '\0') return NULL;
+    /* Skip javascript:, mailto:, data:, etc. */
+    if (g_ascii_strncasecmp(ref, "javascript:", 11) == 0 ||
+        g_ascii_strncasecmp(ref, "mailto:", 7) == 0 ||
+        g_ascii_strncasecmp(ref, "tel:", 4) == 0 ||
+        g_ascii_strncasecmp(ref, "data:", 5) == 0 ||
+        g_ascii_strncasecmp(ref, "#", 1) == 0) {
+        return NULL;
+    }
+    GError *err = NULL;
+    char *resolved = g_uri_resolve_relative(base, ref, G_URI_FLAGS_PARSE_RELAXED, &err);
+    if (err) {
+        g_error_free(err);
+        return NULL;
+    }
+    return resolved;
+}
+
+/* Return the host of an absolute URL, or NULL. Caller frees. */
+static char *url_host(const char *abs_url) {
+    GError *err = NULL;
+    GUri *uri = g_uri_parse(abs_url, G_URI_FLAGS_PARSE_RELAXED, &err);
+    if (!uri) {
+        if (err) g_error_free(err);
+        return NULL;
+    }
+    const char *h = g_uri_get_host(uri);
+    char *out = h ? g_strdup(h) : NULL;
+    g_uri_unref(uri);
+    return out;
+}
+
+/* Return the scheme of an absolute URL (lowercased), or NULL. */
+static char *url_scheme(const char *abs_url) {
+    GError *err = NULL;
+    GUri *uri = g_uri_parse(abs_url, G_URI_FLAGS_PARSE_RELAXED, &err);
+    if (!uri) {
+        if (err) g_error_free(err);
+        return NULL;
+    }
+    const char *s = g_uri_get_scheme(uri);
+    char *out = s ? g_ascii_strdown(s, -1) : NULL;
+    g_uri_unref(uri);
+    return out;
+}
+
+/* Normalize a URL by stripping its fragment. Returns a newly-allocated
+ * string. Caller frees. */
+static char *strip_fragment(const char *abs_url) {
+    const char *hash = strchr(abs_url, '#');
+    if (!hash) return g_strdup(abs_url);
+    return g_strndup(abs_url, (gsize)(hash - abs_url));
+}
+
+/* ── Fetch ──────────────────────────────────────────────────────────── */
+
+/* Fetch a URL synchronously. On success returns the response body bytes
+ * (caller frees with g_bytes_unref) and the final (post-redirect) URL
+ * via out_final_url (caller frees). Returns NULL on failure. */
+static GBytes *dl_fetch(dl_state_t *st, const char *url, char **out_final_url,
+                        const char **out_content_type) {
+    SoupMessage *msg = soup_message_new("GET", url);
+    if (!msg) return NULL;
+
+    /* Allow libsoup to follow redirects automatically (the default). */
+    GError *err = NULL;
+    GBytes *body = soup_session_send_and_read(st->session, msg, NULL, &err);
+
+    /* Capture the final URL and content type BEFORE unreffing the message.
+     * The content-type string returned by soup points into the message's
+     * internal headers, which are freed when the message is unreffed — so
+     * we must dup it. */
+    if (out_final_url) {
+        GUri *muri = soup_message_get_uri(msg);
+        char *fu = muri ? g_uri_to_string(muri) : NULL;
+        *out_final_url = fu ? fu : g_strdup(url);
+    }
+    const char *raw_ctype = soup_message_headers_get_content_type(
+        soup_message_get_response_headers(msg), NULL);
+    char *ctype_copy = raw_ctype ? g_strdup(raw_ctype) : NULL;
+    if (out_content_type) {
+        *out_content_type = ctype_copy;
+    } else {
+        g_free(ctype_copy);
+    }
+
+    gboolean failed = FALSE;
+    if (err) {
+        failed = TRUE;
+        g_error_free(err);
+    } else if (soup_message_get_status(msg) >= 400) {
+        failed = TRUE;
+    }
+
+    g_object_unref(msg);
+
+    if (failed) {
+        if (body) g_bytes_unref(body);
+        return NULL;
+    }
+    return body;
+}
+
+/* Write bytes to a file, creating parent dirs. Returns 0 on success. */
+static int write_bytes_to_file(const char *path, GBytes *bytes) {
+    if (ensure_parent_dir(path) != 0) return -1;
+    gsize size = 0;
+    gconstpointer data = g_bytes_get_data(bytes, &size);
+    FILE *f = fopen(path, "wb");
+    if (!f) return -1;
+    size_t w = fwrite(data, 1, size, f);
+    int rc = (w == size) ? 0 : -1;
+    if (fclose(f) != 0) rc = -1;
+    return rc;
+}
+
+/* Write a NUL-terminated string to a file, creating parent dirs. */
+static int write_text_to_file(const char *path, const char *text, size_t len) {
+    if (ensure_parent_dir(path) != 0) return -1;
+    FILE *f = fopen(path, "wb");
+    if (!f) return -1;
+    size_t w = fwrite(text, 1, len, f);
+    int rc = (w == len) ? 0 : -1;
+    if (fclose(f) != 0) rc = -1;
+    return rc;
+}
+
+/* ── HTML link extraction & rewriting ────────────────────────────────── */
+
+/* A simple, regex-based HTML link extractor/rewriter. We don't depend
+ * on a real HTML parser, so this is best-effort: it handles common
+ * attribute forms (quoted with " or ', or unquoted) and rewrites
+ * href/src/poster attributes whose target is same-origin or an asset
+ * we have saved. Cross-origin links are left untouched.
+ *
+ * Returns a newly-allocated rewritten HTML string. *out_links is set
+ * to a GPtrArray of newly-allocated absolute URL strings for same-
+ * origin pages and assets to fetch (caller frees the array and each
+ * element). */
+
+/* Append a range of the original text to a GString. */
+static void append_range(GString *out, const char *html, gsize start, gsize end) {
+    if (end > start) g_string_append_len(out, html + start, end - start);
+}
+
+/* Given an attribute value (without quotes) from the HTML, resolve it
+ * against the page URL and decide what to do:
+ *   - If it resolves to a same-origin URL, compute its on-disk relative
+ *     path, append that relative path to `out`, and add the absolute URL
+ *     to `links` (with the kind: page or asset). Returns the rewritten
+ *     value (newly allocated) or NULL if the link should be left as-is.
+ *   - Cross-origin / non-http links: return NULL (leave unchanged).
+ *
+ * `is_asset_attr` is TRUE for src/srcset/poster (always download), FALSE
+ * for href (only crawl if same-origin HTML page).
+ */
+enum link_kind { LINK_NONE, LINK_PAGE, LINK_ASSET };
+
+/* Compute a relative path from the page's directory to the target file.
+ * Both `page_rel` and `target_rel` are site-root-relative paths (e.g.
+ * "local-site/about.html" and "local-site/assets/site.css"). Returns a
+ * newly-allocated relative path like "assets/site.css" or
+ * "../subdir/page.html" that works when the page is opened via file://.
+ * Caller frees. */
+static char *relpath_between(const char *page_rel, const char *target_rel) {
+    /* Find the common directory prefix of the two paths. */
+    const char *p = page_rel;
+    const char *t = target_rel;
+    const char *p_last_slash = NULL;
+    const char *t_last_slash = NULL;
+    while (*p && *t && *p == *t) {
+        if (*p == '/') {
+            p_last_slash = p;
+            t_last_slash = t;
+        }
+        p++;
+        t++;
+    }
+    /* If we matched up to a slash, the common prefix ends there. If the
+     * paths diverged mid-segment, back up to the last common slash. */
+    const char *common_end_p;
+    const char *common_end_t;
+    if (p_last_slash && (*p == '\0' || *t == '\0' || *p != *t)) {
+        /* Diverged after a complete segment. */
+        if (*p == '/' || *p == '\0') {
+            common_end_p = p;
+            common_end_t = t;
+        } else {
+            common_end_p = p_last_slash + 1;
+            common_end_t = t_last_slash + 1;
+        }
+    } else if (p_last_slash) {
+        common_end_p = p_last_slash + 1;
+        common_end_t = t_last_slash + 1;
+    } else {
+        common_end_p = page_rel;
+        common_end_t = target_rel;
+    }
+
+    /* Count how many directories we need to go up from the page's
+     * directory (the part of page_rel after the common prefix, minus
+     * the final filename). */
+    int up = 0;
+    for (const char *c = common_end_p; *c; c++) {
+        if (*c == '/') up++;
+    }
+    /* The page's filename doesn't count as a directory to traverse. */
+
+    /* Build the result: up * "../" + remaining target path. */
+    GString *out = g_string_new(NULL);
+    for (int i = 0; i < up; i++) {
+        g_string_append(out, "../");
+    }
+    g_string_append(out, common_end_t);
+    return g_string_free(out, FALSE);
+}
+
+static enum link_kind classify_link(dl_state_t *st, const char *page_url,
+                                    const char *raw_value, char **out_abs,
+                                    char **out_relpath) {
+    *out_abs = NULL;
+    *out_relpath = NULL;
+
+    char *abs = resolve_url(page_url, raw_value);
+    if (!abs) return LINK_NONE;
+
+    char *scheme = url_scheme(abs);
+    if (!scheme || (g_ascii_strcasecmp(scheme, "http") != 0 &&
+                    g_ascii_strcasecmp(scheme, "https") != 0)) {
+        g_free(scheme);
+        g_free(abs);
+        return LINK_NONE;
+    }
+    g_free(scheme);
+
+    char *host = url_host(abs);
+    gboolean same_origin = (host && st->host &&
+                            g_ascii_strcasecmp(host, st->host) == 0);
+    g_free(host);
+
+    if (!same_origin) {
+        g_free(abs);
+        return LINK_NONE;
+    }
+
+    /* Strip fragment for storage/crawl decisions. */
+    char *nofrag = strip_fragment(abs);
+    g_free(abs);
+    abs = nofrag;
+
+    char *target_rel = url_to_relpath(abs);
+    char *page_rel = url_to_relpath(page_url);
+    char *rel = relpath_between(page_rel, target_rel);
+    g_free(page_rel);
+    g_free(target_rel);
+    *out_abs = abs;
+    *out_relpath = rel;
+
+    /* Heuristic: if the relpath ends with .html/.htm, treat as a page
+     * to crawl; otherwise it's an asset (still download, don't crawl). */
+    const char *ext = strrchr(rel, '.');
+    if (ext && (g_ascii_strcasecmp(ext, ".html") == 0 ||
+                g_ascii_strcasecmp(ext, ".htm") == 0)) {
+        return LINK_PAGE;
+    }
+    /* If url_to_relpath appended index.html (directory-style URL), it's
+     * a page. Detect by checking the original path didn't have a file
+     * extension — url_to_relpath already produced an .html path. */
+    if (g_str_has_suffix(rel, "/index.html") || g_str_has_suffix(rel, "index.html")) {
+        /* Could be a real index.html asset or a directory page; treat
+         * directory-style (path ended with /) as a page. We can't
+         * perfectly tell here, so treat any index.html as a page. */
+        return LINK_PAGE;
+    }
+    return LINK_ASSET;
+}
+
+/* The real rewriter. Scans the HTML for href=, src=, srcset=, and
+ * poster= attributes, rewrites same-origin targets to relative paths,
+ * and collects links to fetch. Returns a newly-allocated rewritten
+ * document. *out_links receives a GPtrArray of absolute URL strings
+ * (caller frees array + elements). */
+static char *rewrite_html(dl_state_t *st, const char *page_url,
+                          const char *html, gsize html_len,
+                          GPtrArray **out_links) {
+    GPtrArray *links = g_ptr_array_new_with_free_func(g_free);
+    GString *out = g_string_sized_new(html_len + 64);
+    gsize i = 0;
+    gsize last_emit = 0;
+
+    /* We scan for the attribute names. For each match we find the '='
+     * and the following quoted/unquoted value. */
+    const char *attrs[] = { "href", "src", "poster", NULL };
+    /* srcset is handled specially (comma-separated list). */
+
+    while (i < html_len) {
+        /* Find the next attribute name occurrence. We look for
+         * "href=", "src=", "poster=" case-insensitively, but only when
+         * preceded by whitespace or a tag boundary to avoid matching
+         * inside text. */
+        gsize best = html_len;
+        int best_attr = -1;
+        for (int a = 0; attrs[a]; a++) {
+            const char *needle = attrs[a];
+            size_t nlen = strlen(needle);
+            /* Search from i forward. */
+            for (gsize j = i; j + nlen + 1 <= html_len; j++) {
+                /* Must be preceded by a non-name char. */
+                if (j > 0) {
+                    char prev = html[j - 1];
+                    if (g_ascii_isalnum(prev) || prev == '-' || prev == '_') {
+                        continue;
+                    }
+                }
+                if (g_ascii_strncasecmp(html + j, needle, nlen) == 0 &&
+                    html[j + nlen] == '=') {
+                    /* Keep the earliest match across all attributes. */
+                    if (j < best) {
+                        best = j;
+                        best_attr = a;
+                    }
+                    break;
+                }
+            }
+        }
+
+        /* Also look for "srcset=". */
+        gsize srcset_pos = html_len;
+        for (gsize j = i; j + 7 + 1 <= html_len; j++) {
+            if (j > 0) {
+                char prev = html[j - 1];
+                if (g_ascii_isalnum(prev) || prev == '-' || prev == '_') continue;
+            }
+            if (g_ascii_strncasecmp(html + j, "srcset", 6) == 0 &&
+                html[j + 6] == '=') {
+                srcset_pos = j;
+                break;
+            }
+        }
+
+        /* Pick the earliest match. */
+        gsize match_pos;
+        gboolean is_srcset = FALSE;
+        int attr_idx = -1;
+        if (srcset_pos < best) {
+            match_pos = srcset_pos;
+            is_srcset = TRUE;
+        } else if (best_attr >= 0) {
+            match_pos = best;
+            attr_idx = best_attr;
+        } else {
+            break; /* no more matches */
+        }
+
+        /* Emit everything up to the attribute name. */
+        append_range(out, html, last_emit, match_pos);
+        last_emit = match_pos;
+
+        /* Find the value. Skip the name and '='. */
+        gsize name_len = is_srcset ? 7 : strlen(attrs[attr_idx]);
+        gsize vstart = match_pos + name_len + 1; /* past '=' */
+        if (vstart >= html_len) {
+            last_emit = vstart;
+            break;
+        }
+
+        char quote = 0;
+        if (html[vstart] == '"' || html[vstart] == '\'') {
+            quote = html[vstart];
+            vstart++;
+        }
+        gsize vend;
+        if (quote) {
+            const char *endq = memchr(html + vstart, quote, html_len - vstart);
+            if (!endq) {
+                /* Unterminated; bail out of this attr, emit rest as-is. */
+                vend = html_len;
+            } else {
+                vend = (gsize)(endq - html);
+            }
+        } else {
+            /* Unquoted: ends at whitespace or '>'. */
+            gsize j = vstart;
+            while (j < html_len && html[j] != ' ' && html[j] != '\t' &&
+                   html[j] != '\n' && html[j] != '\r' && html[j] != '>') {
+                j++;
+            }
+            vend = j;
+        }
+
+        /* Extract the raw value. */
+        char *raw = g_strndup(html + vstart, vend - vstart);
+
+        if (is_srcset) {
+            /* srcset is a comma-separated list of "URL [descriptor]".
+             * Rewrite each URL portion. */
+            GString *newval = g_string_new("");
+            gchar **parts = g_strsplit(raw, ",", -1);
+            for (gint k = 0; parts && parts[k]; k++) {
+                gchar *part = g_strstrip(parts[k]);
+                if (!part || !*part) continue;
+                if (k > 0 && newval->len > 0) g_string_append_c(newval, ',');
+                /* Split URL and optional descriptor. */
+                gchar *sp = strchr(part, ' ');
+                char *url_part;
+                char *desc = NULL;
+                if (sp) {
+                    url_part = g_strndup(part, (gsize)(sp - part));
+                    desc = g_strdup(sp); /* includes the space */
+                } else {
+                    url_part = g_strdup(part);
+                }
+                char *abs = NULL, *rel = NULL;
+                (void)classify_link(st, page_url, url_part, &abs, &rel);
+                if (abs && rel) {
+                    g_string_append(newval, rel);
+                    if (desc) g_string_append(newval, desc);
+                    g_ptr_array_add(links, abs);
+                    g_free(rel);
+                } else {
+                    g_string_append(newval, url_part);
+                    if (desc) g_string_append(newval, desc);
+                }
+                g_free(url_part);
+                g_free(desc);
+            }
+            g_strfreev(parts);
+            /* Emit: name=quote + newval + quote. */
+            g_string_append_len(out, html + match_pos, name_len + 1); /* "srcset=" */
+            if (quote) g_string_append_c(out, quote);
+            g_string_append(newval, "");
+            if (quote) g_string_append_c(out, quote);
+            g_string_free(newval, TRUE);
+            g_free(raw);
+            last_emit = (quote && vend < html_len) ? vend + 1 : vend;
+            i = last_emit;
+            continue;
+        }
+
+        /* Single URL attribute (href/src/poster). */
+        char *abs = NULL, *rel = NULL;
+        (void)classify_link(st, page_url, raw, &abs, &rel);
+        if (abs && rel) {
+            /* Rewrite to the relative path. */
+            g_string_append_len(out, html + match_pos, name_len + 1); /* "href=" etc. */
+            if (quote) g_string_append_c(out, quote);
+            g_string_append(out, rel);
+            if (quote) g_string_append_c(out, quote);
+            /* For href to a page, enqueue for crawling; for assets,
+             * also enqueue (we download them). */
+            g_ptr_array_add(links, abs);
+            g_free(rel);
+        } else {
+            /* Leave unchanged. */
+            g_string_append_len(out, html + match_pos,
+                                (quote ? (vend + 1) : vend) - match_pos);
+        }
+        g_free(raw);
+
+        last_emit = (quote && vend < html_len) ? vend + 1 : vend;
+        i = last_emit;
+    }
+
+    /* Emit any remaining text. */
+    append_range(out, html, last_emit, html_len);
+
+    *out_links = links;
+    return g_string_free(out, FALSE);
+}
+
+/* ── Content-type heuristic ──────────────────────────────────────────── */
+
+static gboolean is_html_content(const char *content_type) {
+    if (!content_type) return FALSE;
+    return (g_ascii_strncasecmp(content_type, "text/html", 9) == 0 ||
+            g_ascii_strncasecmp(content_type, "application/xhtml+xml", 21) == 0 ||
+            g_ascii_strncasecmp(content_type, "text/xml", 8) == 0);
+}
+
+/* ── Worker thread ──────────────────────────────────────────────────── */
+
+static gpointer dl_worker(dl_state_t *st) {
+    const browser_settings_t *s = settings_get();
+    int max_pages = s->offline_site_max_pages;
+    int delay_ms  = s->offline_site_request_delay_ms;
+
+    /* Enqueue the start URL. */
+    char *start_nofrag = strip_fragment(st->start_url);
+    g_queue_push_tail(st->queue, start_nofrag);
+    g_hash_table_add(st->visited, g_strdup(start_nofrag));
+
+    while (!g_atomic_int_get(&st->cancel) &&
+           !g_queue_is_empty(st->queue)) {
+
+        if (g_atomic_int_get(&st->pages) >= max_pages) break;
+        if (g_atomic_int_get(&st->files) >= DL_MAX_ASSETS) break;
+
+        char *url = (char *)g_queue_pop_head(st->queue);
+
+        /* Politeness delay. */
+        if (delay_ms > 0) {
+            g_usleep((guint64)delay_ms * 1000);
+        }
+
+        char *final_url = NULL;
+        const char *ctype = NULL;
+        GBytes *body = dl_fetch(st, url, &final_url, &ctype);
+        if (!body) {
+            g_atomic_int_inc(&st->failed);
+            g_free(url);
+            g_free(final_url);
+            dl_post_progress(st);
+            continue;
+        }
+
+        /* Use the final (post-redirect) URL for path mapping, but keep
+         * the requested URL in the visited set. If the final URL is
+         * same-origin and not yet visited, also mark it. */
+        const char *effective_url = final_url ? final_url : url;
+        char *eff_host = url_host(effective_url);
+        gboolean eff_same = (eff_host && st->host &&
+                             g_ascii_strcasecmp(eff_host, st->host) == 0);
+        g_free(eff_host);
+        if (!eff_same) {
+            /* Redirected off-site: save the body under the requested
+             * URL's path but don't crawl further from it. */
+            effective_url = url;
+        } else if (final_url) {
+            char *fnf = strip_fragment(final_url);
+            if (!g_hash_table_contains(st->visited, fnf)) {
+                g_hash_table_add(st->visited, g_strdup(fnf));
+            }
+            g_free(fnf);
+        }
+
+        char *rel = url_to_relpath(effective_url);
+        char *path = disk_path(st->root_dir, rel);
+
+        if (is_html_content(ctype)) {
+            /* Phase 1: Rewrite static HTML links and save as a baseline.
+             * This handles traditional sites where all links are in the
+             * HTML source. For SPAs, this saves the raw HTML (with few
+             * or no links) which Phase 2 may overwrite with the rendered
+             * version. */
+            gsize blen = 0;
+            gconstpointer bdata = g_bytes_get_data(body, &blen);
+            GPtrArray *links = NULL;
+            char *rewritten = rewrite_html(st, effective_url,
+                                           (const char *)bdata, blen, &links);
+            if (rewritten) {
+                write_text_to_file(path, rewritten, strlen(rewritten));
+                g_free(rewritten);
+            } else {
+                write_bytes_to_file(path, body);
+            }
+            g_atomic_int_inc(&st->pages);
+            g_atomic_int_inc(&st->files);
+
+            /* Phase 2: Render the page in WebKit to discover JS-generated
+             * links (SPAs). This loads the page in a hidden webview, lets
+             * JavaScript render, extracts all links from the rendered DOM,
+             * rewrites them to relative paths, and returns the rewritten
+             * rendered HTML. We overwrite the saved file with the rendered
+             * version (which has working JS-generated links) and merge the
+             * rendered links into the crawl. */
+            if (!g_atomic_int_get(&st->cancel)) {
+                char *rendered_html = NULL;
+                GPtrArray *rendered_links = dl_render_page(st, effective_url,
+                                                            &rendered_html);
+                if (rendered_html) {
+                    /* Overwrite with the rendered version. */
+                    write_text_to_file(path, rendered_html,
+                                       strlen(rendered_html));
+                    g_free(rendered_html);
+                }
+                if (rendered_links) {
+                    /* Merge rendered links into the static links array. */
+                    for (guint k = 0; k < rendered_links->len; k++) {
+                        const char *rl = (const char *)g_ptr_array_index(rendered_links, k);
+                        g_ptr_array_add(links, g_strdup(rl));
+                    }
+                    g_ptr_array_free(rendered_links, TRUE);
+                }
+            }
+
+            /* Enqueue new links (from both static and rendered sources). */
+            if (links) {
+                for (guint k = 0; k < links->len; k++) {
+                    const char *lu = (const char *)g_ptr_array_index(links, k);
+                    char *lnf = strip_fragment(lu);
+                    if (!g_hash_table_contains(st->visited, lnf)) {
+                        /* Determine if it's a page or asset by relpath. */
+                        char *lrel = url_to_relpath(lnf);
+                        gboolean is_page = (g_str_has_suffix(lrel, ".html") ||
+                                            g_str_has_suffix(lrel, ".htm"));
+                        g_free(lrel);
+                        g_hash_table_add(st->visited, g_strdup(lnf));
+                        if (is_page) {
+                            /* Only crawl pages under the start URL's path
+                             * prefix. This keeps the crawl focused on the
+                             * section the user asked to download, rather
+                             * than the entire site. */
+                            gboolean under_prefix = TRUE;
+                            if (st->path_prefix && st->path_prefix[0]) {
+                                GError *perr = NULL;
+                                GUri *luri = g_uri_parse(lnf,
+                                    G_URI_FLAGS_PARSE_RELAXED, &perr);
+                                if (luri) {
+                                    const char *lp = g_uri_get_path(luri);
+                                    if (lp && st->path_prefix) {
+                                        if (!g_str_has_prefix(lp,
+                                                st->path_prefix)) {
+                                            under_prefix = FALSE;
+                                        }
+                                    }
+                                    g_uri_unref(luri);
+                                } else if (perr) {
+                                    g_error_free(perr);
+                                }
+                            }
+                            if (under_prefix) {
+                                if (g_atomic_int_get(&st->pages) +
+                                    (gint)g_queue_get_length(st->queue) < max_pages) {
+                                    g_queue_push_tail(st->queue, g_strdup(lnf));
+                                }
+                            }
+                        } else {
+                            /* Fetch asset immediately (don't crawl). */
+                            if (g_atomic_int_get(&st->files) < DL_MAX_ASSETS &&
+                                !g_atomic_int_get(&st->cancel)) {
+                                char *afinal = NULL;
+                                const char *actype = NULL;
+                                GBytes *abody = dl_fetch(st, lnf, &afinal, &actype);
+                                if (abody) {
+                                    const char *aeff = afinal ? afinal : lnf;
+                                    char *ahost = url_host(aeff);
+                                    gboolean asame = (ahost && st->host &&
+                                        g_ascii_strcasecmp(ahost, st->host) == 0);
+                                    g_free(ahost);
+                                    const char *asset_url = asame ? aeff : lnf;
+                                    char *arel = url_to_relpath(asset_url);
+                                    char *apath = disk_path(st->root_dir, arel);
+                                    write_bytes_to_file(apath, abody);
+                                    g_atomic_int_inc(&st->files);
+                                    g_free(apath);
+                                    g_free(arel);
+                                    g_bytes_unref(abody);
+                                }
+                                g_free(afinal);
+                            }
+                        }
+                    }
+                    g_free(lnf);
+                }
+                g_ptr_array_free(links, TRUE);
+            }
+        } else {
+            /* Non-HTML asset: save as-is. */
+            write_bytes_to_file(path, body);
+            g_atomic_int_inc(&st->files);
+        }
+
+        g_bytes_unref(body);
+        g_free(path);
+        g_free(rel);
+        g_free(url);
+        g_free(final_url);
+        g_free((char *)ctype);  /* ctype is a heap copy from dl_fetch */
+
+        dl_post_progress(st);
+    }
+
+    /* Final progress update + completion. */
+    dl_post_progress(st);
+
+    /* Schedule completion on the main thread. */
+    g_idle_add_full(G_PRIORITY_DEFAULT_IDLE,
+                    (GSourceFunc)dl_open_result_tab, g_strdup(st->root_dir), g_free);
+
+    return NULL;
+}
+
+/* ── Progress UI (main thread) ──────────────────────────────────────── */
+
+typedef struct {
+    dl_state_t *st;
+} progress_idle_t;
+
+static gboolean update_progress_ui(gpointer data) {
+    progress_idle_t *p = (progress_idle_t *)data;
+    dl_state_t *st = p->st;
+
+    if (st->dialog == NULL || !GTK_IS_WIDGET(st->dialog)) {
+        g_free(p);
+        return G_SOURCE_REMOVE;
+    }
+
+    int pages = g_atomic_int_get(&st->pages);
+    int files = g_atomic_int_get(&st->files);
+    int failed = g_atomic_int_get(&st->failed);
+
+    char buf[256];
+    g_snprintf(buf, sizeof(buf),
+               "Pages: %d   Files: %d   Failed: %d",
+               pages, files, failed);
+    gtk_label_set_text(GTK_LABEL(st->status_label), buf);
+
+    const browser_settings_t *s = settings_get();
+    double frac = (double)pages / (double)s->offline_site_max_pages;
+    if (frac > 1.0) frac = 1.0;
+    if (frac < 0.0) frac = 0.0;
+    gtk_progress_bar_set_fraction(GTK_PROGRESS_BAR(st->progress_bar), frac);
+
+    g_free(p);
+    return G_SOURCE_REMOVE;
+}
+
+/* Post a progress update to the main thread, throttled. Called from the
+ * worker thread. */
+static void dl_post_progress(dl_state_t *st) {
+    gint64 now = g_get_monotonic_time() / 1000; /* ms */
+    if (now - st->last_ui_update_ms < DL_PROGRESS_UPDATE_MS) return;
+    st->last_ui_update_ms = now;
+
+    progress_idle_t *p = g_new(progress_idle_t, 1);
+    p->st = st;
+    g_idle_add(update_progress_ui, p);
+}
+
+/* Cancel button handler. */
+static void on_dl_cancel(GtkButton *button, gpointer data) {
+    (void)button;
+    dl_state_t *st = (dl_state_t *)data;
+    g_atomic_int_set(&st->cancel, 1);
+}
+
+/* Dialog delete-event (window close button): treat as cancel. */
+static gboolean on_dl_delete(GtkWidget *widget, GdkEvent *event, gpointer data) {
+    (void)widget; (void)event;
+    dl_state_t *st = (dl_state_t *)data;
+    g_atomic_int_set(&st->cancel, 1);
+    return TRUE; /* keep the dialog open; the completion handler closes it */
+}
+
+/* ── Completion (main thread) ───────────────────────────────────────── */
+
+/* Open the offline index.html in a new tab and destroy the dialog. */
+static gboolean dl_open_result_tab(gpointer data) {
+    char *root_dir = (char *)data;
+
+    /* The active download state, set by site_downloader_start and cleared
+     * by the completion callback. Only one download runs at a time. */
+    dl_state_t *st = g_active_dl;
+
+    if (st && st->dialog && GTK_IS_WIDGET(st->dialog)) {
+        gtk_dialog_response(GTK_DIALOG(st->dialog), GTK_RESPONSE_CLOSE);
+        gtk_widget_destroy(st->dialog);
+        st->dialog = NULL;
+    }
+
+    /* Open the offline copy of the start page in a new tab. Map the
+     * start URL to its on-disk relative path (e.g. local-site/index.html)
+     * rather than assuming index.html lives at the site root. */
+    char *start_rel = NULL;
+    if (st && st->start_url) {
+        start_rel = url_to_relpath(st->start_url);
+    }
+    char *page_path;
+    if (start_rel) {
+        page_path = g_build_filename(root_dir, start_rel, NULL);
+        g_free(start_rel);
+    } else {
+        page_path = g_build_filename(root_dir, "index.html", NULL);
+    }
+    if (access(page_path, F_OK) == 0) {
+        char *uri = g_strdup_printf("file://%s", page_path);
+        tab_manager_new_tab(uri);
+        g_free(uri);
+    } else {
+        /* Fall back to the directory listing so the user sees what was
+         * saved. */
+        char *uri = g_strdup_printf("file://%s/", root_dir);
+        tab_manager_new_tab(uri);
+        g_free(uri);
+    }
+    g_free(page_path);
+
+    /* Free the state. */
+    if (st) {
+        g_free(st->start_url);
+        g_free(st->root_dir);
+        g_free(st->host);
+        g_free(st->path_prefix);
+        if (st->session) g_object_unref(st->session);
+        if (st->queue) {
+            g_queue_free_full(st->queue, g_free);
+        }
+        if (st->visited) {
+            g_hash_table_destroy(st->visited);
+        }
+        g_free(st);
+        g_active_dl = NULL;
+    }
+
+    return G_SOURCE_REMOVE;
+}
+
+/* (g_active_dl is declared above, near the top of the file.) */
+
+/* ── Public entry point ─────────────────────────────────────────────── */
+
+void site_downloader_start(const char *start_url, GtkWindow *parent) {
+    if (!start_url || !start_url[0]) return;
+
+    /* Validate scheme. */
+    char *scheme = url_scheme(start_url);
+    if (!scheme || (g_ascii_strcasecmp(scheme, "http") != 0 &&
+                    g_ascii_strcasecmp(scheme, "https") != 0)) {
+        g_free(scheme);
+        GtkWidget *err = gtk_message_dialog_new(
+            parent,
+            GTK_DIALOG_DESTROY_WITH_PARENT,
+            GTK_MESSAGE_ERROR,
+            GTK_BUTTONS_OK,
+            "Download Website is only available for http:// and https:// pages.");
+        gtk_dialog_run(GTK_DIALOG(err));
+        gtk_widget_destroy(err);
+        return;
+    }
+    g_free(scheme);
+
+    /* Only one download at a time. */
+    if (g_active_dl != NULL) {
+        GtkWidget *err = gtk_message_dialog_new(
+            parent,
+            GTK_DIALOG_DESTROY_WITH_PARENT,
+            GTK_MESSAGE_INFO,
+            GTK_BUTTONS_OK,
+            "A website download is already in progress.");
+        gtk_dialog_run(GTK_DIALOG(err));
+        gtk_widget_destroy(err);
+        return;
+    }
+
+    /* Determine the host (same-origin scope). */
+    char *host = url_host(start_url);
+    if (!host) {
+        GtkWidget *err = gtk_message_dialog_new(
+            parent,
+            GTK_DIALOG_DESTROY_WITH_PARENT,
+            GTK_MESSAGE_ERROR,
+            GTK_BUTTONS_OK,
+            "Could not determine the website's host.");
+        gtk_dialog_run(GTK_DIALOG(err));
+        gtk_widget_destroy(err);
+        return;
+    }
+
+    /* Determine the on-disk root directory. */
+    char root_dir[DL_MAX_PATH_LEN];
+    const char *pubkey = app_get_pubkey_hex();
+    if (pubkey && pubkey[0]) {
+        char profile_dir[DL_MAX_PATH_LEN];
+        profile_get_dir(pubkey, profile_dir, sizeof(profile_dir));
+        g_snprintf(root_dir, sizeof(root_dir), "%s/offline_sites/%s",
+                   profile_dir, host);
+    } else {
+        const char *home = g_get_home_dir();
+        g_snprintf(root_dir, sizeof(root_dir),
+                   "%s/.sovereign_browser/offline_sites/%s", home, host);
+    }
+    if (mkdir_p(root_dir, 0755) != 0) {
+        GtkWidget *err = gtk_message_dialog_new(
+            parent,
+            GTK_DIALOG_DESTROY_WITH_PARENT,
+            GTK_MESSAGE_ERROR,
+            GTK_BUTTONS_OK,
+            "Could not create the offline site directory:\n%s", root_dir);
+        gtk_dialog_run(GTK_DIALOG(err));
+        gtk_widget_destroy(err);
+        g_free(host);
+        return;
+    }
+
+    /* Build the progress dialog. */
+    GtkWidget *dialog = gtk_dialog_new_with_buttons(
+        "Download Website",
+        parent,
+        GTK_DIALOG_DESTROY_WITH_PARENT,
+        "_Cancel", GTK_RESPONSE_CANCEL,
+        NULL);
+    GtkWidget *content = gtk_dialog_get_content_area(GTK_DIALOG(dialog));
+    gtk_box_set_spacing(GTK_BOX(content), 8);
+    g_object_set(G_OBJECT(content), "margin", 12, NULL);
+
+    char host_buf[256];
+    g_snprintf(host_buf, sizeof(host_buf), "Downloading: %s", host);
+    GtkWidget *host_label = gtk_label_new(host_buf);
+    gtk_widget_set_halign(host_label, GTK_ALIGN_START);
+    gtk_box_pack_start(GTK_BOX(content), host_label, FALSE, FALSE, 0);
+
+    GtkWidget *status_label = gtk_label_new("Pages: 0   Files: 0   Failed: 0");
+    gtk_widget_set_halign(status_label, GTK_ALIGN_START);
+    gtk_box_pack_start(GTK_BOX(content), status_label, FALSE, FALSE, 0);
+
+    GtkWidget *progress_bar = gtk_progress_bar_new();
+    gtk_progress_bar_set_show_text(GTK_PROGRESS_BAR(progress_bar), TRUE);
+    gtk_box_pack_start(GTK_BOX(content), progress_bar, FALSE, FALSE, 0);
+
+    GtkWidget *hint = gtk_label_new(
+        "Same-origin pages and assets are being saved. "
+        "The offline copy will open in a new tab when done.");
+    gtk_widget_set_halign(hint, GTK_ALIGN_START);
+    gtk_label_set_line_wrap(GTK_LABEL(hint), TRUE);
+    gtk_box_pack_start(GTK_BOX(content), hint, FALSE, FALSE, 0);
+
+    gtk_widget_show_all(content);
+
+    /* Build the state. */
+    dl_state_t *st = g_new0(dl_state_t, 1);
+    st->start_url = g_strdup(start_url);
+    st->root_dir  = g_strdup(root_dir);
+    st->host      = host; /* takes ownership */
+
+    /* Compute the path prefix for restricting page crawling. We use the
+     * directory portion of the start URL's path. E.g. for
+     *   https://example.com/auctions/2026/07/essential-design
+     * the prefix is "/auctions/2026/07/essential-design" (the full path,
+     * since "essential-design" has no file extension — it's a directory-
+     * style URL). For
+     *   https://example.com/docs/index.html
+     * the prefix is "/docs/" (the parent directory of index.html).
+     *
+     * Pages under this prefix are crawled; same-origin pages outside it
+     * are NOT crawled (but their assets are still downloaded if linked
+     * from a crawled page). This keeps the crawl focused on the section
+     * the user asked to download, rather than the entire site. */
+    {
+        GError *perr = NULL;
+        GUri *suri = g_uri_parse(start_url, G_URI_FLAGS_PARSE_RELAXED, &perr);
+        if (suri) {
+            const char *sp = g_uri_get_path(suri);
+            if (sp && sp[0]) {
+                /* If the last segment has a file extension, strip it to
+                 * get the directory. Otherwise use the full path. */
+                const char *last_slash = strrchr(sp, '/');
+                const char *base = last_slash ? last_slash + 1 : sp;
+                const char *dot = strrchr(base, '.');
+                if (dot && dot > base) {
+                    /* Has an extension — use the directory portion. */
+                    if (last_slash) {
+                        st->path_prefix = g_strndup(sp, (gsize)(last_slash - sp) + 1);
+                    } else {
+                        st->path_prefix = g_strdup("/");
+                    }
+                } else {
+                    /* No extension — use the full path as prefix. */
+                    st->path_prefix = g_strdup(sp);
+                }
+            } else {
+                st->path_prefix = g_strdup("/");
+            }
+            g_uri_unref(suri);
+        } else {
+            st->path_prefix = g_strdup("/");
+            if (perr) g_error_free(perr);
+        }
+    }
+
+    st->session   = soup_session_new();
+    soup_session_set_timeout(st->session, 30);
+    st->queue     = g_queue_new();
+    st->visited   = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
+    st->parent    = parent;
+    st->dialog    = dialog;
+    st->status_label   = status_label;
+    st->progress_bar   = progress_bar;
+    st->host_label     = host_label;
+    st->last_ui_update_ms = 0;
+
+    g_active_dl = st;
+
+    /* Wire the Cancel button and delete-event. */
+    g_signal_connect(gtk_dialog_get_widget_for_response(GTK_DIALOG(dialog),
+                     GTK_RESPONSE_CANCEL),
+                     "clicked", G_CALLBACK(on_dl_cancel), st);
+    g_signal_connect(dialog, "delete-event", G_CALLBACK(on_dl_delete), st);
+
+    /* Start the worker thread. */
+    g_thread_new("site-downloader", (GThreadFunc)dl_worker, st);
+
+    /* Run the dialog modally. The worker posts progress via idle
+     * callbacks and eventually calls dl_open_result_tab which destroys
+     * the dialog. We use gtk_dialog_run so the main loop spins to
+     * process idle callbacks while the dialog is shown. */
+    gtk_dialog_run(GTK_DIALOG(dialog));
+
+    /* If the dialog is still around (e.g. user closed it via window
+     * manager before completion), destroy it. */
+    if (st->dialog && GTK_IS_WIDGET(st->dialog)) {
+        gtk_widget_destroy(st->dialog);
+        st->dialog = NULL;
+    }
+}
diff --git a/src/site_downloader.h b/src/site_downloader.h
new file mode 100644
index 0000000..0f3007c
--- /dev/null
+++ b/src/site_downloader.h
@@ -0,0 +1,43 @@
+/*
+ * site_downloader.h — download a website for offline viewing
+ *
+ * Triggered from the tab right-click context menu ("Download Website").
+ * Crawls the current site (same-origin, bounded by a page-count cap),
+ * saves all pages and assets to a per-profile directory, rewrites links
+ * to relative paths, and opens the offline copy in a new tab via file://.
+ *
+ * See plans/download-website-offline.md for the full design.
+ */
+
+#ifndef SITE_DOWNLOADER_H
+#define SITE_DOWNLOADER_H
+
+#include <gtk/gtk.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Start downloading the website at start_url.
+ *
+ * Shows a modal progress dialog (pages/files counts + progress bar +
+ * Cancel button) parented to `parent`. A background thread runs a BFS
+ * crawl over same-origin links using libsoup, saving pages and assets
+ * under ~/.sovereign_browser/profiles/<pubkey>/offline_sites/<host>/
+ * (or the global ~/.sovereign_browser/offline_sites/<host>/ when not
+ * logged in). On completion or cancel, the progress dialog is closed
+ * and the offline index.html is opened in a new tab.
+ *
+ * No-op (shows an error dialog) for non-http(s) URLs.
+ *
+ *   start_url — absolute http:// or https:// URL of the page to download
+ *   parent    — the GtkWindow to parent the progress dialog to (may be NULL)
+ */
+void site_downloader_start(const char *start_url, GtkWindow *parent);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SITE_DOWNLOADER_H */
diff --git a/src/tab_manager.c b/src/tab_manager.c
index 55333a9..0aebb83 100644
--- a/src/tab_manager.c
+++ b/src/tab_manager.c
@@ -21,6 +21,7 @@
 #include "db.h"
 #include "net_services.h"
 #include "agent_chat.h"   /* agent_chat_route_input() for ";" URL-bar shortcut */
+#include "site_downloader.h"
 
 #include <string.h>
 #include <strings.h>   /* strcasecmp */
@@ -168,6 +169,7 @@ static int          tab_array_find(tab_info_t *tab);
 static GtkWidget   *build_hamburger_menu(tab_info_t *tab);
 static char        *normalize_url(const char *input);
 static void         on_tab_close_clicked_proxy_new(GtkMenuItem *item, gpointer data);
+static void         on_tab_download_website(GtkMenuItem *item, gpointer data);
 static void         on_avatar_clicked(GtkButton *btn, gpointer data);
 static GtkWidget   *tab_manager_new_window(const char *url,
                                             WebKitWebView *related_view);
@@ -797,6 +799,15 @@ static gboolean on_notebook_button_press(GtkWidget *widget,
                                          GINT_TO_POINTER(index));
                 gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_reload);
 
+                gtk_menu_shell_append(GTK_MENU_SHELL(menu),
+                                      gtk_separator_menu_item_new());
+
+                GtkWidget *item_dl =
+                    gtk_menu_item_new_with_label("Download Website");
+                g_signal_connect(item_dl, "activate",
+                                 G_CALLBACK(on_tab_download_website), tab);
+                gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_dl);
+
                 gtk_widget_show_all(menu);
                 gtk_menu_popup_at_pointer(GTK_MENU(menu), (GdkEvent *)event);
                 return TRUE;
@@ -875,6 +886,15 @@ static gboolean on_tab_label_button_press(GtkWidget *widget,
                                  GINT_TO_POINTER(index));
         gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_reload);
 
+        gtk_menu_shell_append(GTK_MENU_SHELL(menu),
+                              gtk_separator_menu_item_new());
+
+        GtkWidget *item_dl =
+            gtk_menu_item_new_with_label("Download Website");
+        g_signal_connect(item_dl, "activate",
+                         G_CALLBACK(on_tab_download_website), tab);
+        gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_dl);
+
         gtk_widget_show_all(menu);
         gtk_menu_popup_at_pointer(GTK_MENU(menu), (GdkEvent *)event);
         return TRUE;
@@ -890,6 +910,19 @@ static void on_tab_close_clicked_proxy_new(GtkMenuItem *item, gpointer data) {
     tab_manager_new_tab(NULL);
 }
 
+/* "Download Website" — crawl the tab's current URL for offline viewing.
+ * The tab_info_t is passed as data; we read its current_url and hand off
+ * to site_downloader_start, which shows a progress dialog and opens the
+ * offline copy in a new tab when done. */
+static void on_tab_download_website(GtkMenuItem *item, gpointer data) {
+    (void)item;
+    tab_info_t *tab = (tab_info_t *)data;
+    if (tab == NULL) return;
+    if (tab->current_url[0] == '\0') return;
+    GtkWindow *parent = g_active_window ? g_active_window : g_window;
+    site_downloader_start(tab->current_url, parent);
+}
+
 /* ── Favicon handling ─────────────────────────────────────────────── *
  * WebKitGTK has a built-in favicon database (WebKitFaviconDatabase) that
  * automatically fetches and caches favicons as pages load. It must be
diff --git a/src/version.h b/src/version.h
index 01da703..69a3041 100644
--- a/src/version.h
+++ b/src/version.h
@@ -11,9 +11,9 @@
 #ifndef SOVEREIGN_BROWSER_VERSION_H
 #define SOVEREIGN_BROWSER_VERSION_H
 
-#define SB_VERSION         "v0.0.56"
+#define SB_VERSION         "v0.0.57"
 #define SB_VERSION_MAJOR   0
 #define SB_VERSION_MINOR   0
-#define SB_VERSION_PATCH   56
+#define SB_VERSION_PATCH   57
 
 #endif /* SOVEREIGN_BROWSER_VERSION_H */