diff --git a/CLAUDE.md b/CLAUDE.md
index 3d0080d6..1cbda053 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -33,7 +33,7 @@ says why. All packages stay in lockstep on one version (see root
 | Package | What it does |
 |---|---|
 | `@fetchproxy/protocol` | Wire format: frame validators, crypto wrappers (X25519, Ed25519, HKDF, AES-GCM, SHA-256), mcp-id parsing, pair-code derivation, JSON-pointer evaluator. Pure functions, no I/O. Smallest dep surface — every other workspace depends on it. |
-| `@fetchproxy/server` | `request()` accepts `viaTab` to name the tab that relays a call — needed for API-only hosts (`api.example.com` serves no page, so its implied tab can never exist; route through the signed-in `www` tab instead). Guarded against the declared domains: it widens which tab performs the fetch, never which origins are reachable. Throws `FetchproxyScopeError` (with `.hint`) for gate-#2 scope rejections, so consumers that re-wrap bridge errors can still surface the re-pair remedy — build extension errors with `protocolErrorFrom()`, never `new FetchproxyProtocolError()` directly. MCP-side WebSocket bridge. `FetchproxyServer` class with `listen()`, `request()`, `fetch()`, `readCookies()`, `readLocalStorage()`, `readSessionStorage()`, `captureRequestHeader()`, `readIndexedDb()`, `graphqlQuery()`, `writeCookies()` (1.12+, the only write verb — see `docs/SECURITY.md` §T-cookie-write). Handles concentrator role-election (host vs peer), identity loading, session-key derivation. Persists per-MCP identity to `~/.fetchproxy/identity/<server-name>.json`. |
+| `@fetchproxy/server` | `request()` accepts `viaTab` to name the tab that relays a call — needed for API-only hosts (`api.example.com` serves no page, so its implied tab can never exist; route through the signed-in `www` tab instead). Guarded against the declared domains: it widens which tab performs the fetch, never which origins are reachable. Throws `FetchproxyScopeError` (with `.hint`) for gate-#2 scope rejections, so consumers that re-wrap bridge errors can still surface the re-pair remedy — build extension errors with `protocolErrorFrom()`, never `new FetchproxyProtocolError()` directly. MCP-side WebSocket bridge. `FetchproxyServer` class with `listen()`, `request()`, `requestBytes()`/`getBytes()` (#460: binary-safe body + relayed headers, run from the extension's background worker, 16 MiB cap derived from the hosted relay's 32 MiB message limit, gated on the extension hello's advisory `features: ['fetch_base64']` and trusted only on the answer's `bodyEncoding` marker), `fetch()`, `readCookies()`, `readLocalStorage()`, `readSessionStorage()`, `captureRequestHeader()`, `readIndexedDb()`, `graphqlQuery()`, `writeCookies()` (1.12+, the only write verb — see `docs/SECURITY.md` §T-cookie-write). Handles concentrator role-election (host vs peer), identity loading, session-key derivation. Persists per-MCP identity to `~/.fetchproxy/identity/<server-name>.json`. |
 | `@fetchproxy/bootstrap` | `createSessionLifter(opts)` returns a **repeatable** lift (declare scope → spin up `FetchproxyServer` → read everything → close, per call) — use it whenever the session can expire, wiring it straight into a session manager's `login`. `bootstrap(opts)` is one invocation of that lifter, kept for genuinely one-shot callers (a user-invoked `capture_session` tool that persists the token). Used by Pattern A MCPs (HoneyBook, OFW, Resy auth-refresh path) that just need a session blob then operate from Node. `storageDomain` selector for multi-domain MCPs. Returns `missing.{cookies,localStorage,sessionStorage}` — declared keys the browser did not return, so a **partial** lift can't masquerade as a clean one (reading the apex when the cookies live on `www` is the classic way to get a half-populated session that fails later somewhere unrelated). |
 | `@fetchproxy/cli` | `fpx` — a one-shot CLI over the same bridge: authenticated fetches and session reads through the user's signed-in browser tab, scoped by per-service **profiles** (each profile connects as `fpx-<name>` with its own identity, so ten services look like ten MCPs to the extension). Published, and it ships v4 changes like any other consumer — `src/bridge-errors.ts` is what names which half of the bridge is behind on a version mismatch. It is also how an operator debugs a straggler during a protocol rollout, without standing an MCP up. |
 | `@fetchproxy/test-helpers` | Published vitest mock helpers for consumers of `@fetchproxy/server` — a drop-in `FetchproxyServer` mock that captures constructor opts and exposes spy-able `request`/`fetch`/`captureRequestHeader`/`bridgeHealth`. Lets cohort MCPs unit-test their fetchproxy usage without a live bridge. |
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index a9584378..a9ff5bfc 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -280,10 +280,17 @@ is also what every server hello is minted in answer to.
   "identityX25519Pub": "<base64 raw 32B>",   // 0.4.0+: long-term
   "identityEd25519Pub": "<base64 raw 32B>",  // 0.4.0+: signs the ready
   "sessionNonce": "<base64 raw 32B, fresh per connection>",
-  "unavailableCapabilities": ["download"]    // #418, optional — see below
+  "unavailableCapabilities": ["download"],   // #418, optional — see below
+  "features": ["fetch_base64"]               // #460, optional — see below
 }
 ```
 
+`features` (#460, optional) lists behaviours this extension build supports
+beyond protocol 4's base. Today one: `fetch_base64`, the binary `fetch` mode.
+Sent only when non-empty, sorted and de-duplicated; same validator bounds and
+unknown-name tolerance as `unavailableCapabilities`, and equally unsigned and
+advisory. See [§Binary fetch](#binary-fetch-460).
+
 `unavailableCapabilities` (#418, optional) lists the capabilities **this
 browser** cannot serve, found by runtime API detection — Safari has no
 `chrome.downloads`, for one. It is sent only when non-empty, sorted and
@@ -773,7 +780,9 @@ Semantics:
 
   Use it only where the isolated world genuinely fails. Some edge bot-managers accept a request from the page and reject the byte-identical one from the isolated world: on opentable.com a GraphQL **mutation** POST 403s from the isolated world and returns 200 from the page, while GraphQL queries and REST writes pass from either. The cost is that page script can see and patch `window.fetch`, so a flagged request loses the isolated world's tamper resistance — see `T-in-page-fetch` in [SECURITY.md](./SECURITY.md). Flag individual calls, never everything.
 
-**Body size caps:** request body ≤ 1 MB, response body ≤ 5 MB. Larger bodies are rejected with `ok: false` — including on the `inPage` path, which re-checks the response cap in the content script before the body leaves it.
+- `responseType`: optional, `"base64"` or absent (#460). Absent is text, unchanged. `"base64"` asks for the body's BYTES and changes where and how the request runs — see [§Binary fetch](#binary-fetch-460). Cannot be combined with `inPage: true`.
+
+**Body size caps:** request body ≤ 1 MB, response body ≤ 5 MB. Larger bodies are rejected with `ok: false` — including on the `inPage` path, which re-checks the response cap in the content script before the body leaves it. A binary (`responseType: "base64"`) response has its own cap, `MAX_BINARY_RESPONSE_BYTES` = 16 MiB.
 
 ##### `op: "read_cookies"`
 
@@ -965,6 +974,98 @@ break. So the list is advisory: it can only make an MCP believe *fewer*
 capabilities are available, never gain one. The analysis, and the optional
 tamper-evident follow-up, are in `docs/SECURITY.md` §T-unavailable-caps.
 
+## Binary fetch (#460)
+
+`fetch` decodes the body with `response.text()`, which is lossy for anything
+that is not UTF-8 text: invalid sequences become U+FFFD and cannot be
+recovered. A PDF, a zip-based office file or an image came back corrupted, and
+a hosted MCP whose files live on a host outside its egress allowlist had no
+route to the bytes. Binary fetch is an opt-in mode of the same verb, additive
+inside protocol 4: no `PROTOCOL_VERSION` bump, no new capability, and nothing
+any signature covers changes.
+
+**Request.** `init.responseType: "base64"`. Everything else is an ordinary
+`fetch` init; `tabUrl` is still required and still domain-checked.
+
+**Response.**
+
+```jsonc
+{
+  "type": "response", "id": 7, "ok": true, "op": "fetch",
+  "status": 200,
+  "url": "https://files.example.com/signed/7?sig=…",   // FINAL url, after redirects
+  "body": "JVBERi0xLjcK…",                             // standard padded base64 of the bytes
+  "bodyEncoding": "base64",
+  "headers": {                                         // relayed subset, lower-cased, each only if present
+    "content-type": "application/pdf",
+    "content-length": "48213",
+    "content-disposition": "attachment; filename=\"report.pdf\""
+  }
+}
+```
+
+The bytes ride in the existing `body` field rather than a new one, so every
+published validator still accepts the frame (they require `body` to be a
+string and ignore the rest); `bodyEncoding` is what makes it unambiguous. A
+text answer carries neither `bodyEncoding` nor `headers` and is byte-for-byte
+what it always was. The validator requires a `bodyEncoding: "base64"` body to
+be strict standard padded base64 (Node's decoder silently skips characters it
+does not understand), and `headers` to be a string map.
+
+**Where it runs.** In the extension's background service worker (event page on
+Safari), not a tab: the extension's `host_permissions` make CORS irrelevant
+there, so a signed file host that sends no CORS headers is readable, and
+`redirect: "follow"` reaches it. Cookies are the browser's for the URL
+(`credentials` is honoured; default `include`).
+
+**Scope — it reaches nothing a text fetch could not be pointed at.** The
+request URL must be on the MCP's declared `domains`, exactly as for text, and
+so must the **final** URL after redirects: an answer whose `response.url`
+left the declared domains is refused before a byte of its body is read. To
+read a signed CDN host, declare it. Intermediate redirect hops are not
+inspectable from `fetch()` (a `manual` redirect is opaque), but they reveal
+nothing to the MCP — their bodies are never read — and a page-level `fetch` has
+always followed the same hops. See `docs/SECURITY.md` §T-binary-fetch.
+
+**Size.** `MAX_BINARY_RESPONSE_BYTES` = 16 MiB of BYTES, derived from the
+transports rather than picked: a binary frame is about 16/9 of the body on the
+wire, so 16 MiB is ~28.5 MiB sealed — under the hosted relay's 32 MiB
+WebSocket message limit (`HOSTED_RELAY_MESSAGE_BYTES`) and `MAX_FRAME_BYTES`
+(42 MiB). The extension refuses early when `content-length` exceeds the cap,
+and again while streaming when the length is absent or lies. The refusal is
+`{ ok: false, op: "fetch", code: "response_too_large", error }` with the fixed
+wording from `responseTooLargeMessage()`, which starts `response body too
+large:` — the prefix every published server already classifies as
+`body_too_large`. The extension's per-frame size gate still applies on top.
+
+**Capability negotiation.** The extension lists `fetch_base64` in its hello
+`features`. A server (3.7.0+):
+
+- refuses a binary request **locally, with no round trip**, when the session's
+  extension hello did not list it — `FetchproxyExtensionUpdateRequiredError`
+  (`.feature`, `.hint`: update ContextMint Bridge); `fetch()` returns the
+  envelope `{ ok: false, kind: "extension_update_required" }`;
+- refuses any answer to a binary request that lacks `bodyEncoding: "base64"`
+  with the same error. This, not the advisory hello list, is what the bytes are
+  trusted on: an older extension ignores `responseType` (its validator predates
+  it) and answers in text, and that text is never decoded as bytes;
+- maps `code: "response_too_large"` / the fixed wording to
+  `FetchproxyResponseTooLargeError` (`.limitBytes`, `.declaredBytes`);
+- re-checks the final URL against its declared `domains` before returning.
+
+`requestBytes(method, path, opts)` / `getBytes(path, opts)` on
+`FetchproxyServer` resolve `{ status, url, headers, bytes: Uint8Array }`. The
+`fpx` CLI exposes it as `fpx get|request <url> -o <file>`.
+
+### Compatibility
+
+| MCP | Extension | What happens |
+|---|---|---|
+| < 3.7.0 | new | Never sends `responseType`, so nothing changes. The extra hello field is ignored (`return raw`). |
+| 3.7.0+ | old (no `features`) | `requestBytes()` refuses locally: update the extension. Text fetches are unaffected. |
+| 3.7.0+ | old, but a relay added `features` | The old extension ignores `responseType` and answers in text; the answer has no marker and is refused with the same update error. |
+| new peer | old host | An old host relays the extension hello as the parsed object, so `features` reaches the peer intact. A host too old to relay the extension hello at all leaves the peer with no list: the request is sent and the marker decides. |
+
 ## The ephemeral's lifetime
 
 Everything above says "the ephemeral this process currently holds" as though
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 061ebade..9db09969 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -474,6 +474,21 @@ Names the MCP does not know are dropped, and the validator bounds the list (≤
 
 **Residual risk:** a party already positioned to relay the extension's frames can make an MCP believe *fewer* capabilities are available than really are, and make its error text blame the browser for it. That is a downgrade to refusal, never an escalation. If the list ever needs to be tamper-evident, the additive fix is an encrypted `session-info` frame (extension → MCP, inside the session, sent only to servers that list it in `accepts`) carrying the same list; this change does not add it.
 
+### T-binary-fetch — A background fetch that ignores CORS (#460)
+
+`fetch` with `responseType: "base64"` runs from the extension's **background worker**, not a tab ([PROTOCOL.md §Binary fetch](PROTOCOL.md#binary-fetch-460)). The manifest's `host_permissions` (`<all_urls>`) mean CORS does not apply there — that is the point, since signed file hosts send no CORS headers — so the extension's own code is the only scope gate, and it has to be at least as tight as the tab path's.
+
+**Defence, in the extension (`background/handlers/fetch-binary.ts` in contextmint-bridge):**
+
+- the request URL must be on the MCP's declared `domains` (the same `isUrlAllowedForAnyDomain` the text path uses), checked before any request is made;
+- the **final** URL after redirects (`response.url`) must be on them too, checked before a byte of the body is read; otherwise the body is cancelled and the request refused. So a declared host with an open redirect cannot be used to READ an undeclared, cookie-authenticated resource (the user's mail, their bank) without CORS standing in the way;
+- `inPage` is refused in this mode, and no tab is involved, so no CSRF token is injected;
+- the body is capped at `MAX_BINARY_RESPONSE_BYTES` early on `content-length` and again while streaming.
+
+**What is not narrowed, and why that is acceptable.** Intermediate redirect hops cannot be inspected from `fetch()` — a `manual` redirect is an opaque response with no `Location` — so a hop may pass through an undeclared host, carrying that host's cookies. Its response body is never read and nothing about it reaches the MCP, and a page-level `fetch()` (and `download`) has always followed the same hops; the browser sends that request either way. What changes relative to the tab path is that the browser may attach `SameSite=Strict`/`Lax` cookies to a request from an extension with host permission where a cross-site tab fetch would not, and that a CORS-less declared host becomes readable. Both are within the scope the user approved: the domains are what they paired the MCP to act on as them.
+
+**The capability flag is advisory.** `features: ["fetch_base64"]` on the extension hello is unsigned, like `unavailableCapabilities` ([§T-unavailable-caps](#t-unavailable-caps--tampering-with-this-browser-cannot-serve-x-418)). Stripping it makes the MCP refuse locally (a relay could already drop frames). Adding it makes the MCP send a binary request to an extension that does not understand it; that extension answers in text, and the server refuses any answer lacking the authenticated `bodyEncoding: "base64"` marker rather than decode text as bytes. It feeds nothing but that local refusal and the health report — never trust, pinning, the pair code, key derivation or a grant.
+
 ## What protocol 4 does not fix
 
 3.0.0 is the largest change to this document's crypto since 0.2.0, which makes it exactly the version whose residuals are worth writing down before somebody infers them away. v4 gives forward secrecy for past sessions and binds every frame to its `mcpId`, its ordinal and its direction. That is all it gives. Each of the following is true the day it ships:
diff --git a/packages/cli/README.md b/packages/cli/README.md
index 1bb10132..a894549b 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -79,6 +79,7 @@ Every verb takes `-p`/`--profile <name>` (except the `profile` subcommands thems
 | `fpx pair -p <name> [--domain <apex>] [--subdomain <label>]` | Force a pairing round-trip against one declared domain (defaults to the only one, if there's exactly one). `--subdomain` aims at the host your signed-in tab is actually on — the fetch tab-matcher is strict-prefix, so an apex-only profile won't match a `www.` tab. | `fpx pair -p opentable --subdomain www` |
 | `fpx health -p <name>` | Print the bridge's health snapshot (host/peer role, connection state). | `fpx health -p opentable` |
 | `fpx get <url> -p <name> [--json] [-H 'K: V']…` | GET a URL through the profile's tab. | `fpx get https://www.opentable.com/ -p opentable` |
+| `fpx get <url> -p <name> -o <file>` | Download the response **bytes** to a file (binary-safe; PDFs, office files, images). Fetched by the extension's background worker, so a CORS-less file host works; the final URL must be on the profile's domains; capped at 16 MiB. Needs a ContextMint Bridge with binary fetch. Also on `fpx request`. | `fpx get https://files.example.com/a.pdf -p files -o a.pdf` |
 | `fpx post-json <url> <body\|@file> -p <name> [--json] [-H 'K: V']…` | POST a JSON body (literal or `@file`); sets `Content-Type: application/json` unless overridden. | `fpx post-json https://www.opentable.com/dapi/fe/gql '{"operationName":"Autocomplete"}' -p opentable` |
 | `fpx request <url> -p <name> [-X METHOD] [-H 'K: V']… [-d body\|@file] [--json]` | Arbitrary method/headers/body. | `fpx request https://www.opentable.com/x -p opentable -X DELETE` |
 | `fpx cookies [keys…] -p <name>` | Read declared cookies (all declared keys if none given). | `fpx cookies -p opentable` |
diff --git a/packages/cli/src/args.ts b/packages/cli/src/args.ts
index 46b4179b..c4a77c3a 100644
--- a/packages/cli/src/args.ts
+++ b/packages/cli/src/args.ts
@@ -28,7 +28,9 @@ export type Command =
   | { kind: 'trust'; action: 'clear'; serverName?: string; all?: boolean }
   | { kind: 'fetch'; profile: string; method: string; url: string;
       headers: Record<string, string>; body?: string; json: boolean; viaTab?: string;
-      inPage: boolean; noCredentials: boolean }
+      inPage: boolean; noCredentials: boolean;
+      /** #460: write the response BYTES here (binary-safe) instead of printing text. */
+      output?: string }
   | { kind: 'read'; profile: string; bucket: Bucket; keys: string[];
       storageDomain?: string; storageSubdomain?: string }
   | { kind: 'session'; profile: string; storageDomain?: string; storageSubdomain?: string }
@@ -391,6 +393,7 @@ export function parseCliArgs(
         'via-tab': { type: 'string' },
         'in-page': { type: 'boolean', default: false },
         'no-credentials': { type: 'boolean', default: false },
+        output: { type: 'string', short: 'o' },
         // SECONDS on the command line, like every other timeout the CLI takes.
         'capture-timeout': { type: 'string' },
         subdomain: { type: 'string' },
@@ -610,7 +613,8 @@ export function parseCliArgs(
       return { kind: 'fetch', profile, method: 'GET', url, headers, body: undefined,
         json: values.json ?? false, viaTab: values['via-tab'],
         inPage: values['in-page'] ?? false,
-        noCredentials: values['no-credentials'] ?? false };
+        noCredentials: values['no-credentials'] ?? false,
+        ...(values.output !== undefined ? { output: values.output } : {}) };
     }
     if (cmd === 'post-json') {
       const rawBody = rest[1];
@@ -628,13 +632,15 @@ export function parseCliArgs(
       return { kind: 'fetch', profile, method: 'POST', url, headers, body,
         json: values.json ?? false, viaTab: values['via-tab'],
         inPage: values['in-page'] ?? false,
-        noCredentials: values['no-credentials'] ?? false };
+        noCredentials: values['no-credentials'] ?? false,
+        ...(values.output !== undefined ? { output: values.output } : {}) };
     }
     const body = values.data === undefined ? undefined : resolveBody(values.data, readFile);
     return { kind: 'fetch', profile, method: (values.method ?? 'GET').toUpperCase(), url,
       headers, body, json: values.json ?? false, viaTab: values['via-tab'],
       inPage: values['in-page'] ?? false,
-      noCredentials: values['no-credentials'] ?? false };
+      noCredentials: values['no-credentials'] ?? false,
+      ...(values.output !== undefined ? { output: values.output } : {}) };
   }
 
   throw new UsageError(`unknown command ${JSON.stringify(cmd)}`, 'run: fpx --help');
diff --git a/packages/cli/src/main.ts b/packages/cli/src/main.ts
index 9c46b189..1ba6c4d9 100644
--- a/packages/cli/src/main.ts
+++ b/packages/cli/src/main.ts
@@ -27,9 +27,9 @@ const USAGE = `fpx ${VERSION} — fetchproxy CLI: authenticated fetches through
   fpx pair -p <name> [--domain <apex>] [--subdomain <label>]
   fpx health -p <name>
   fpx trust list | clear <server-name> | clear --all
-  fpx get <url> -p <name> [--json] [-H 'K: V']… [--via-tab <url>] [--in-page] [--no-credentials]
+  fpx get <url> -p <name> [--json] [-H 'K: V']… [--via-tab <url>] [--in-page] [--no-credentials] [-o <file>]
   fpx post-json <url> <body|@file> -p <name> [--json] [-H …]… [--via-tab <url>] [--in-page] [--no-credentials]
-  fpx request <url> -p <name> [-X METHOD] [-H …]… [-d body|@file] [--json] [--via-tab <url>] [--in-page] [--no-credentials]
+  fpx request <url> -p <name> [-X METHOD] [-H …]… [-d body|@file] [--json] [--via-tab <url>] [--in-page] [--no-credentials] [-o <file>]
   fpx cookies|local-storage|session-storage|indexeddb [keys…] -p <name> [--storage-domain d] [--storage-subdomain s]
   fpx capture [header@host…] -p <name> [--capture-timeout <s>]
   fpx write-cookies <name=value|name=@file…> | --from-stdin -p <name> [--storage-domain d] [--storage-subdomain s]
@@ -45,6 +45,11 @@ request's own host. Needed for API hosts that serve no page — e.g. fetch
 api.example.com through --via-tab https://www.example.com/. Must be on a
 declared domain.
 
+-o/--output writes the response BYTES to a file (PDFs, office files, images),
+fetched by the extension's background worker — so a file host that sends no
+CORS headers still works — and capped at 16 MiB. Needs a ContextMint Bridge
+that supports binary fetch; cannot be combined with --via-tab or --in-page.
+
 A cookie value typed on the command line lands in shell history, in ps output
 and in /proc/<pid>/cmdline. Keep it off argv: name=@file reads the value from
 that file (exactly one trailing newline is stripped), and --from-stdin reads
diff --git a/packages/cli/src/verbs/fetch.ts b/packages/cli/src/verbs/fetch.ts
index 281a8408..fe915ea5 100644
--- a/packages/cli/src/verbs/fetch.ts
+++ b/packages/cli/src/verbs/fetch.ts
@@ -1,3 +1,4 @@
+import { writeFileSync } from 'node:fs';
 import { classifyBotWall, FetchproxyServer } from '@fetchproxy/server';
 import type { Command } from '../args.js';
 import type { Profile } from '../profiles.js';
@@ -19,6 +20,15 @@ export interface VerbServer {
       credentials?: 'include' | 'omit';
     },
   ): Promise<{ status: number; body: string; url: string }>;
+  /** #460: the same request with the body returned as bytes. */
+  requestBytes(
+    method: string,
+    path: string,
+    opts?: {
+      headers?: Record<string, string>; body?: string; domain?: string;
+      credentials?: 'include' | 'omit';
+    },
+  ): Promise<{ status: number; url: string; headers: Record<string, string>; bytes: Uint8Array }>;
   readCookies(o: { keys: string[]; domain?: string; subdomain?: string }): Promise<string>;
   readLocalStorage(o: { keys: string[]; domain?: string; subdomain?: string }): Promise<Record<string, string>>;
   readSessionStorage(o: { keys: string[]; domain?: string; subdomain?: string }): Promise<Record<string, string>>;
@@ -144,13 +154,27 @@ export function assertUrlOnProfile(url: string, profile: Profile): string {
 // hand-rolled in resy-mcp, @chrischall/mcp-utils and onehome-mcp; it belongs
 // in the library, and this is the deletion that says so.
 
+/** Where `--output` puts the bytes. Injected so tests never touch the disk. */
+export type BytesWriter = (path: string, bytes: Uint8Array) => void;
+
+const defaultBytesWriter: BytesWriter = (path, bytes) => writeFileSync(path, bytes);
+
 export async function runFetch(
   cmd: Extract<Command, { kind: 'fetch' }>,
   profile: Profile,
   io: Io,
   makeServer: VerbServerFactory = defaultServerFactory,
+  writeBytes: BytesWriter = defaultBytesWriter,
 ): Promise<number> {
   const domain = assertUrlOnProfile(cmd.url, profile);
+  // #460: a binary fetch runs from the extension's background worker, not a
+  // tab, so the two tab-selecting flags would be silently meaningless.
+  if (cmd.output !== undefined && (cmd.inPage || cmd.viaTab !== undefined)) {
+    throw new UsageError(
+      '--output cannot be combined with --in-page or --via-tab',
+      'a binary download is fetched by the extension itself, not through a tab — drop the tab flag',
+    );
+  }
   // Same reasoning as the relay-tab check below: the extension refuses an
   // undeclared capability, but that refusal arrives after the bridge is up and
   // reads as a bridge error rather than the usage error it is. Worse here,
@@ -174,6 +198,28 @@ export async function runFetch(
   });
   try {
     await server.listen();
+    if (cmd.output !== undefined) {
+      const bin = await server.requestBytes(cmd.method, cmd.url, {
+        headers: Object.keys(cmd.headers).length ? cmd.headers : undefined,
+        body: cmd.body,
+        domain,
+        ...(cmd.noCredentials ? { credentials: 'omit' as const } : {}),
+      });
+      writeBytes(cmd.output, bin.bytes);
+      if (cmd.json) {
+        io.out(JSON.stringify({
+          status: bin.status, url: bin.url, headers: bin.headers,
+          bytes: bin.bytes.length, path: cmd.output,
+        }, null, 2));
+      } else {
+        io.err(`wrote ${bin.bytes.length} bytes to ${cmd.output}`);
+      }
+      if (bin.status < 200 || bin.status >= 300) {
+        io.err(`HTTP ${bin.status} ${bin.url}`);
+        return EXIT.HTTP;
+      }
+      return EXIT.OK;
+    }
     const res = await server.request(cmd.method, cmd.url, {
       headers: Object.keys(cmd.headers).length ? cmd.headers : undefined,
       body: cmd.body,
diff --git a/packages/cli/tests/args.test.ts b/packages/cli/tests/args.test.ts
index ae1f8cf2..aaf284c2 100644
--- a/packages/cli/tests/args.test.ts
+++ b/packages/cli/tests/args.test.ts
@@ -589,3 +589,21 @@ describe('capture-redirect / graphql parsing', () => {
     expect(() => asGraphql(['graphql', '-p', 'x'])).toThrow(UsageError);
   });
 });
+
+describe('--output (#460)', () => {
+  it('parses -o / --output on get and request', () => {
+    for (const argv of [
+      ['get', 'https://x.com/a.pdf', '-p', 'x', '-o', 'a.pdf'],
+      ['request', 'https://x.com/a.pdf', '-p', 'x', '--output', 'a.pdf'],
+    ]) {
+      const cmd = parseCliArgs(argv) as Extract<ReturnType<typeof parseCliArgs>, { kind: 'fetch' }>;
+      expect(cmd.output, `--output lost on: ${argv[0]}`).toBe('a.pdf');
+    }
+  });
+
+  it('is absent by default, so an ordinary fetch is unchanged', () => {
+    const cmd = parseCliArgs(['get', 'https://x.com/a', '-p', 'x']) as
+      Extract<ReturnType<typeof parseCliArgs>, { kind: 'fetch' }>;
+    expect(cmd.output).toBeUndefined();
+  });
+});
diff --git a/packages/cli/tests/fetch.test.ts b/packages/cli/tests/fetch.test.ts
index a216a969..0396b7fd 100644
--- a/packages/cli/tests/fetch.test.ts
+++ b/packages/cli/tests/fetch.test.ts
@@ -300,3 +300,56 @@ describe('assertHostOnProfile — domain case is not a rule the server has', ()
     expect(() => assertHostOnProfile('NotExample.com', prof)).toThrow(UsageError);
   });
 });
+
+describe('runFetch --output (#460): binary download through the bridge', () => {
+  const ALL = Uint8Array.from({ length: 256 }, (_, i) => i);
+  const binServer = (status = 200): VerbServer & { closed: boolean } =>
+    stubServer({
+      requestBytes: vi.fn(async () => ({
+        status,
+        url: CMD.url,
+        headers: { 'content-type': 'application/pdf' },
+        bytes: ALL,
+      })),
+    } as never);
+
+  it('writes the exact bytes to the file and reports on stderr, nothing on stdout', async () => {
+    const io = memIo();
+    const server = binServer();
+    const writes: Array<[string, Uint8Array]> = [];
+    const code = await runFetch({ ...CMD, output: 'out.pdf' }, PROFILE, io, () => server,
+      (p, b) => { writes.push([p, b]); });
+    expect(code).toBe(EXIT.OK);
+    expect(server.request).not.toHaveBeenCalled();
+    expect(server.requestBytes).toHaveBeenCalledWith('GET', CMD.url, expect.objectContaining({ domain: 'tripadvisor.com' }));
+    expect(writes).toHaveLength(1);
+    expect(writes[0][0]).toBe('out.pdf');
+    expect(Array.from(writes[0][1])).toEqual(Array.from(ALL));
+    expect(io.outs).toEqual([]);
+    expect(io.errs.join('\n')).toMatch(/256 bytes/);
+  });
+
+  it('--json prints status, url, headers, byte count and path — never the bytes', async () => {
+    const io = memIo();
+    await runFetch({ ...CMD, output: 'out.pdf', json: true }, PROFILE, io, () => binServer(), () => {});
+    expect(JSON.parse(io.outs[0])).toEqual({
+      status: 200, url: CMD.url, headers: { 'content-type': 'application/pdf' }, bytes: 256, path: 'out.pdf',
+    });
+  });
+
+  it('non-2xx: still writes the body, exits 4 with the status', async () => {
+    const io = memIo();
+    const code = await runFetch({ ...CMD, output: 'out.pdf' }, PROFILE, io, () => binServer(404), () => {});
+    expect(code).toBe(EXIT.HTTP);
+    expect(io.errs.join('\n')).toMatch(/HTTP 404/);
+  });
+
+  it('refuses --output with --in-page or --via-tab: a binary fetch runs from the background, not a tab', async () => {
+    const factory = vi.fn();
+    await expect(runFetch({ ...CMD, output: 'o', inPage: true } as never,
+      { ...PROFILE, inPage: true }, memIo(), factory)).rejects.toThrow(UsageError);
+    await expect(runFetch({ ...CMD, output: 'o', viaTab: 'https://www.tripadvisor.com/' } as never,
+      PROFILE, memIo(), factory)).rejects.toThrow(UsageError);
+    expect(factory).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/protocol/src/binary-fetch.ts b/packages/protocol/src/binary-fetch.ts
new file mode 100644
index 00000000..9abac8f1
--- /dev/null
+++ b/packages/protocol/src/binary-fetch.ts
@@ -0,0 +1,162 @@
+/**
+ * #460: binary `fetch` — an opt-in mode that carries a response's BYTES.
+ *
+ * Every `fetch` before this decoded the body with `response.text()`, which is
+ * lossy: invalid UTF-8 becomes U+FFFD and cannot be recovered, so a PDF, a
+ * zip-based office file or an image came back corrupted. A hosted MCP whose
+ * files live on a host it cannot reach directly had no route to the bytes.
+ *
+ * The mode is additive inside protocol 4, in four places:
+ *
+ * 1. `FetchInit.responseType: 'base64'` asks for it. Absent means text, and a
+ *    text request's frame is byte-for-byte what it was.
+ * 2. The answer reuses `body`, holding standard padded base64, marked
+ *    `bodyEncoding: 'base64'`, beside a relayed header subset
+ *    ({@link RELAYED_RESPONSE_HEADERS}). Reusing `body` keeps every published
+ *    validator accepting the frame (they require `body` to be a string and
+ *    ignore the rest); the marker is what makes the bytes unambiguous.
+ * 3. `HelloFrameFromExtension.features` lists {@link EXTENSION_FEATURE_FETCH_BASE64}
+ *    when the extension can serve it, so a server can refuse locally — "update
+ *    the extension" — rather than send a request an older extension would
+ *    silently answer as text. Unsigned and advisory, like
+ *    `unavailableCapabilities`: the marker in (2) is what a server trusts.
+ * 4. A refusal for size carries `code: 'response_too_large'` and the wording
+ *    from {@link responseTooLargeMessage}.
+ *
+ * Nothing here feeds trust, pinning, the pair code, key derivation or a grant.
+ */
+
+/** `FetchInit.responseType` value that asks for the body as base64 bytes. */
+export const FETCH_RESPONSE_TYPE_BASE64 = 'base64' as const;
+
+/** The response types a `FetchInit` may name. Absent means text. */
+export type FetchResponseType = typeof FETCH_RESPONSE_TYPE_BASE64;
+
+/**
+ * Feature names an extension may list in its hello. One today. A name this
+ * build does not know is admitted by the validator and ignored by a receiver,
+ * so an extension can add one without refusing older MCPs.
+ */
+export const EXTENSION_FEATURE_FETCH_BASE64 = 'fetch_base64' as const;
+
+export type ExtensionFeature = typeof EXTENSION_FEATURE_FETCH_BASE64;
+
+export const KNOWN_EXTENSION_FEATURES: ReadonlySet<ExtensionFeature> = new Set<ExtensionFeature>([
+  EXTENSION_FEATURE_FETCH_BASE64,
+]);
+
+/** Upper bound the validator puts on `features`. */
+export const MAX_EXTENSION_FEATURES = 32;
+
+/** Bounds on one feature name's length, in UTF-16 code units. */
+export const MAX_EXTENSION_FEATURE_LENGTH = 64;
+
+/**
+ * What the extension spreads into its hello: `{}` for nothing, so a hello
+ * listing no features keeps its old bytes, otherwise sorted and de-duplicated.
+ */
+export function extensionFeaturesHelloField(features: Iterable<ExtensionFeature>): {
+  features?: ExtensionFeature[];
+} {
+  const list = [...new Set(features)].sort();
+  return list.length === 0 ? {} : { features: list };
+}
+
+/**
+ * The per-message limit of the hosted relay a remote bridge link crosses —
+ * a Cloudflare Durable Object WebSocket, which accepts at most 32 MiB in one
+ * message. A frame over it is not refused per request: the platform closes
+ * the socket, and every session on that link goes with it.
+ *
+ * Recorded here because it is the binding limit for the binary cap below, and
+ * a test holds the cap's worst-case frame under it. It is NOT enforced by this
+ * package; {@link MAX_FRAME_BYTES} is the receiver cap the protocol enforces.
+ */
+export const HOSTED_RELAY_MESSAGE_BYTES = 32 * 1024 * 1024;
+
+/**
+ * The largest binary body, in BYTES, an extension relays in one response.
+ *
+ * Derived from the two transport limits, not picked for convenience. A
+ * binary body crosses as base64 inside JSON (×4/3, and base64 needs no JSON
+ * escaping), then the sealed frame base64s the ciphertext again (×4/3), so the
+ * wire frame is about 16/9 of the body:
+ *
+ * ```
+ *   16 MiB body                         16,777,216 bytes
+ *   base64 in the inner frame           22,369,624
+ *   + url, relayed headers, keys        ~   12,000  (an 8 KB URL is generous)
+ *   + AES-GCM tag, ×4/3, envelope       29,842,000  ≈ 28.5 MiB on the wire
+ * ```
+ *
+ * That clears the hosted relay's 32 MiB message limit
+ * ({@link HOSTED_RELAY_MESSAGE_BYTES}) with room for a long URL, and
+ * {@link MAX_FRAME_BYTES} (42 MiB) easily. 20 MiB would already be 35.6 MiB
+ * on the wire and close a hosted link; 25 MiB would exceed the local cap too.
+ * Raising this needs a chunked transfer, not a bigger number.
+ */
+export const MAX_BINARY_RESPONSE_BYTES = 16 * 1024 * 1024;
+
+/**
+ * The response headers a binary answer relays, lower-cased. Exactly what a
+ * server needs before it trusts a body — what it is, how big it claimed to
+ * be, and what it is called — and nothing that would leak more of the
+ * response (no `set-cookie`, which the browser withholds anyway).
+ */
+export const RELAYED_RESPONSE_HEADERS = [
+  'content-type',
+  'content-length',
+  'content-disposition',
+] as const;
+
+export type RelayedResponseHeader = (typeof RELAYED_RESPONSE_HEADERS)[number];
+
+/** `InnerResponseError.code` for a body over the binary cap. */
+export const RESPONSE_TOO_LARGE_CODE = 'response_too_large' as const;
+
+/**
+ * The fixed wording of a binary-size refusal. It starts `response body too
+ * large:` on purpose: every published server already classifies that prefix
+ * as `body_too_large`, so an MCP older than this refusal still files it in
+ * the right bucket.
+ *
+ * `declaredBytes` is set when the refusal came from `content-length`, before
+ * any of the body was read; absent when the cap was hit while streaming
+ * (no length, or one that lied).
+ */
+export function responseTooLargeMessage(info: {
+  limitBytes: number;
+  declaredBytes?: number;
+}): string {
+  return info.declaredBytes !== undefined
+    ? `response body too large: content-length ${info.declaredBytes} exceeds the ${info.limitBytes}-byte binary cap`
+    : `response body too large: more than the ${info.limitBytes}-byte binary cap was received`;
+}
+
+const TOO_LARGE_DECLARED_RE =
+  /^response body too large: content-length (\d{1,16}) exceeds the (\d{1,16})-byte binary cap/;
+const TOO_LARGE_STREAMED_RE =
+  /^response body too large: more than the (\d{1,16})-byte binary cap was received/;
+
+/** Parse {@link responseTooLargeMessage}'s wording back out, or `null`. */
+export function parseResponseTooLarge(
+  error: string,
+): { limitBytes: number; declaredBytes: number | null } | null {
+  const declared = TOO_LARGE_DECLARED_RE.exec(error);
+  if (declared) return { limitBytes: Number(declared[2]), declaredBytes: Number(declared[1]) };
+  const streamed = TOO_LARGE_STREAMED_RE.exec(error);
+  if (streamed) return { limitBytes: Number(streamed[1]), declaredBytes: null };
+  return null;
+}
+
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+
+/**
+ * Is `s` standard, padded base64 with no whitespace — exactly what `btoa`
+ * produces? Strict on purpose: Node's `Buffer.from(s, 'base64')` silently
+ * drops characters it does not understand, so a lenient check here would let
+ * a corrupted body decode to the wrong bytes without a word.
+ */
+export function isBase64Body(s: string): boolean {
+  return s.length % 4 === 0 && BASE64_RE.test(s);
+}
diff --git a/packages/protocol/src/frames.ts b/packages/protocol/src/frames.ts
index e67e3d52..fe962425 100644
--- a/packages/protocol/src/frames.ts
+++ b/packages/protocol/src/frames.ts
@@ -90,6 +90,7 @@
 
 import { sha256 } from './crypto.js';
 import { fromB64 } from './encoding.js';
+import type { FetchResponseType } from './binary-fetch.js';
 
 export const PROTOCOL_VERSION = 4 as const;
 
@@ -852,6 +853,23 @@ export interface HelloFrameFromExtension {
    * §T-unavailable-caps.
    */
   unavailableCapabilities?: Capability[];
+  /**
+   * #460: optional behaviours THIS extension build supports beyond protocol
+   * 4's base, so a server can tell before sending whether a request will be
+   * understood — today only `'fetch_base64'` (`FetchInit.responseType`). Sent
+   * only when non-empty, sorted and de-duplicated — build it with
+   * `extensionFeaturesHelloField()`.
+   *
+   * Additive and shape-checked like `unavailableCapabilities` (≤ 32 strings
+   * of 1–64 characters, unknown names admitted, so a newer extension is never
+   * refused by an older validator). UNSIGNED and advisory: a relay can strip
+   * an entry (the server then refuses locally, which a relay could already
+   * cause by dropping frames) or add one (the server then sends a request the
+   * extension answers in text, and the server refuses that answer for lacking
+   * the `bodyEncoding` marker). It must never feed trust, pinning, the pair
+   * code, key derivation or a grant. docs/SECURITY.md §T-binary-fetch.
+   */
+  features?: string[];
 }
 
 export type HelloFrame = HelloFrameFromServer | HelloFrameFromExtension;
@@ -1266,6 +1284,25 @@ export interface FetchInit {
    * anonymous, and an anonymous 200 is worse than an honest failure.
    */
   credentials?: 'include' | 'omit';
+  /**
+   * #460: `'base64'` asks for the response BODY AS BYTES. Absent means text,
+   * exactly as before — a request without it is byte-for-byte unchanged.
+   *
+   * The extension answers with the bytes base64-encoded in `body`, marked
+   * `bodyEncoding: 'base64'`, plus a relayed header subset
+   * (`RELAYED_RESPONSE_HEADERS`). It runs the request from its background
+   * worker rather than a tab, so a file host that sends no CORS headers is
+   * still readable, and caps the body at `MAX_BINARY_RESPONSE_BYTES` (refusing
+   * early on `content-length`, and again while streaming). The URL, and the
+   * FINAL URL after redirects, must both be on the MCP's declared domains.
+   * `inPage` cannot be combined with it.
+   *
+   * A server must check the extension lists `fetch_base64` in its hello
+   * `features` before sending this: an older extension ignores the field and
+   * answers in text, which is why a server also refuses any answer that does
+   * not carry the `bodyEncoding` marker. See `binary-fetch.ts`.
+   */
+  responseType?: FetchResponseType;
 }
 
 export interface InnerPing {
@@ -1610,7 +1647,23 @@ export interface InnerResponseFetchOk {
   op: 'fetch';
   status: number;
   url: string;
+  /**
+   * The response body. Text as the page decoded it — unless `bodyEncoding` is
+   * `'base64'`, in which case it is the body's BYTES as standard padded base64.
+   */
   body: string;
+  /**
+   * #460: present, and `'base64'`, only on the answer to a request that asked
+   * for `responseType: 'base64'`. A receiver must treat its ABSENCE on such an
+   * answer as "this extension does not do binary" — never decode text as bytes.
+   */
+  bodyEncoding?: 'base64';
+  /**
+   * #460: on a binary answer, the relayed subset of the response's headers
+   * (`RELAYED_RESPONSE_HEADERS`, lower-cased names), each present only when the
+   * response carried it. Absent on a text answer, which stays unchanged.
+   */
+  headers?: Record<string, string>;
 }
 
 export interface InnerResponseReadCookiesOk {
diff --git a/packages/protocol/src/index.ts b/packages/protocol/src/index.ts
index d77cc2f3..ce39e341 100644
--- a/packages/protocol/src/index.ts
+++ b/packages/protocol/src/index.ts
@@ -2,6 +2,7 @@ export * from './frames.js';
 export * from './account-attest.js';
 export * from './awaiting-approval.js';
 export * from './capability-availability.js';
+export * from './binary-fetch.js';
 export {
   assertCookiePath,
   validateFrame,
diff --git a/packages/protocol/src/validate.ts b/packages/protocol/src/validate.ts
index 1f5ec9bb..15275c4f 100644
--- a/packages/protocol/src/validate.ts
+++ b/packages/protocol/src/validate.ts
@@ -28,6 +28,12 @@ import {
   MAX_CAPABILITY_NAME_LENGTH,
   MAX_UNAVAILABLE_CAPABILITIES,
 } from './capability-availability.js';
+import {
+  FETCH_RESPONSE_TYPE_BASE64,
+  MAX_EXTENSION_FEATURES,
+  MAX_EXTENSION_FEATURE_LENGTH,
+  isBase64Body,
+} from './binary-fetch.js';
 import { isValidMcpId } from './mcp-id.js';
 import {
   ACCOUNT_ATTEST_CONSENTS,
@@ -860,6 +866,9 @@ function validateHello(raw: Record<string, unknown>): HelloFrame {
     if (raw.unavailableCapabilities !== undefined) {
       assertUnavailableCapabilities(raw.unavailableCapabilities);
     }
+    // #460: optional behaviours this extension supports. Shape only, unknown
+    // names admitted — the same posture as `unavailableCapabilities`.
+    if (raw.features !== undefined) assertExtensionFeatures(raw.features);
     return raw as unknown as HelloFrame;
   }
   throw new ProtocolError(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
@@ -980,6 +989,24 @@ function assertAcceptsList(accepts: unknown): void {
   }
 }
 
+function assertExtensionFeatures(list: unknown): void {
+  const label = 'hello.features';
+  if (!Array.isArray(list)) throw new ProtocolError(`${label}: expected array`);
+  if (list.length > MAX_EXTENSION_FEATURES) {
+    throw new ProtocolError(`${label}: at most ${MAX_EXTENSION_FEATURES} entries, got ${list.length}`);
+  }
+  for (const f of list) {
+    if (typeof f !== 'string') {
+      throw new ProtocolError(`${label}: entry must be string, got ${typeof f}`);
+    }
+    if (f.length < 1 || f.length > MAX_EXTENSION_FEATURE_LENGTH) {
+      throw new ProtocolError(
+        `${label}: entry must be 1-${MAX_EXTENSION_FEATURE_LENGTH} characters, got ${f.length}`,
+      );
+    }
+  }
+}
+
 function assertUnavailableCapabilities(list: unknown): void {
   const label = 'hello.unavailableCapabilities';
   if (!Array.isArray(list)) throw new ProtocolError(`${label}: expected array`);
@@ -1298,6 +1325,15 @@ function validateInnerRequest(raw: Record<string, unknown>): InnerFrame {
         throw new ProtocolError("inner.init.credentials: must be 'include' or 'omit'");
       }
     }
+    if (raw.init.responseType !== undefined) {
+      // #460: closed set. Absent means text; the one other value asks the
+      // extension for the body's bytes. An older extension never reaches
+      // here (its validator predates the field and ignores it), which is why
+      // the server also refuses a binary request's answer without the marker.
+      if (raw.init.responseType !== FETCH_RESPONSE_TYPE_BASE64) {
+        throw new ProtocolError("inner.init.responseType: must be 'base64' when present");
+      }
+    }
     return raw as unknown as InnerFrame;
   }
   if (raw.op === 'read_cookies') {
@@ -1687,6 +1723,18 @@ function validateInnerResponse(raw: Record<string, unknown>): InnerFrame {
       assertPositiveInt(raw.status, 'inner.status');
       assertString(raw.url, 'inner.url');
       assertString(raw.body, 'inner.body');
+      if (raw.bodyEncoding !== undefined) {
+        // #460: the only encoding is base64, and a body marked with it must
+        // BE base64 — strictly, because Node's decoder skips characters it
+        // does not understand and would hand back the wrong bytes silently.
+        if (raw.bodyEncoding !== 'base64') {
+          throw new ProtocolError("inner.bodyEncoding: must be 'base64' when present");
+        }
+        if (!isBase64Body(raw.body)) {
+          throw new ProtocolError('inner.body: not standard padded base64 under bodyEncoding base64');
+        }
+      }
+      if (raw.headers !== undefined) assertStringMap(raw.headers, 'inner.headers');
       return raw as unknown as InnerFrame;
     }
     if (op === 'read_cookies') {
diff --git a/packages/protocol/tests/fetch-base64.test.ts b/packages/protocol/tests/fetch-base64.test.ts
new file mode 100644
index 00000000..0dcb2867
--- /dev/null
+++ b/packages/protocol/tests/fetch-base64.test.ts
@@ -0,0 +1,248 @@
+import { describe, it, expect } from 'vitest';
+import {
+  validateFrame,
+  validateInnerFrame,
+  encodeInnerFrame,
+  sealedFrameWireBytes,
+  toB64,
+  extensionFeaturesHelloField,
+  isBase64Body,
+  parseResponseTooLarge,
+  responseTooLargeMessage,
+  EXTENSION_FEATURE_FETCH_BASE64,
+  HOSTED_RELAY_MESSAGE_BYTES,
+  KNOWN_EXTENSION_FEATURES,
+  MAX_BINARY_RESPONSE_BYTES,
+  MAX_EXTENSION_FEATURES,
+  MAX_FRAME_BYTES,
+  MAX_EXTENSION_FEATURE_LENGTH,
+  RELAYED_RESPONSE_HEADERS,
+  RESPONSE_TOO_LARGE_CODE,
+  type HelloFrameFromExtension,
+  type InnerResponseFetchOk,
+} from '../src/index.js';
+
+/**
+ * #460: an opt-in binary mode for `fetch`. The request asks with
+ * `init.responseType: 'base64'`; the answer carries the bytes base64-encoded
+ * in the same `body` field, marked `bodyEncoding: 'base64'`, plus a small
+ * relayed header subset. Additive inside protocol 4: text-mode frames are
+ * byte-for-byte what they were, and the extension advertises support in an
+ * unsigned, advisory `features` list on its hello.
+ */
+
+const fetchReq = {
+  type: 'request',
+  id: 1,
+  op: 'fetch',
+  init: { url: 'https://files.example.com/a.pdf', method: 'GET', tabUrl: 'https://example.com/' },
+};
+
+describe('FetchInit.responseType — request validator', () => {
+  it('accepts a request without it (every sender before #460)', () => {
+    expect(() => validateInnerFrame(fetchReq)).not.toThrow();
+  });
+
+  it("accepts 'base64' and passes it through", () => {
+    const f = validateInnerFrame({ ...fetchReq, init: { ...fetchReq.init, responseType: 'base64' } });
+    expect((f as { init: { responseType?: string } }).init.responseType).toBe('base64');
+  });
+
+  it.each(['text', 'arraybuffer', '', 1, true, null])('refuses responseType %j', (v) => {
+    expect(() =>
+      validateInnerFrame({ ...fetchReq, init: { ...fetchReq.init, responseType: v } }),
+    ).toThrow(/inner\.init\.responseType/);
+  });
+});
+
+const okText = { type: 'response', id: 1, ok: true, op: 'fetch', status: 200, url: 'https://example.com/', body: 'hi' };
+
+describe('fetch response — bodyEncoding and headers', () => {
+  it('a text response is unchanged: no bodyEncoding, no headers', () => {
+    const f = validateInnerFrame(okText) as InnerResponseFetchOk;
+    expect(f).toEqual(okText);
+    // Byte-for-byte: the encoder emits exactly the keys it was given.
+    expect(new TextDecoder().decode(encodeInnerFrame(okText as InnerResponseFetchOk))).toBe(
+      JSON.stringify(okText),
+    );
+  });
+
+  it('accepts a base64 body with the relayed headers', () => {
+    const bytes = new Uint8Array(256).map((_, i) => i);
+    const frame = {
+      ...okText,
+      body: toB64(bytes),
+      bodyEncoding: 'base64',
+      headers: {
+        'content-type': 'application/pdf',
+        'content-length': '256',
+        'content-disposition': 'attachment; filename="a.pdf"',
+      },
+    };
+    expect(validateInnerFrame(frame)).toEqual(frame);
+  });
+
+  it('accepts an empty base64 body (a zero-byte file)', () => {
+    expect(() => validateInnerFrame({ ...okText, body: '', bodyEncoding: 'base64', headers: {} })).not.toThrow();
+  });
+
+  it.each(['utf8', 'hex', '', 7])('refuses bodyEncoding %j', (v) => {
+    expect(() => validateInnerFrame({ ...okText, bodyEncoding: v })).toThrow(/inner\.bodyEncoding/);
+  });
+
+  it.each(['not base64!', 'abc', 'ab=c', 'YQ===', 'YWJj\n'])(
+    'refuses a base64-marked body that is not standard padded base64: %j',
+    (body) => {
+      expect(() => validateInnerFrame({ ...okText, body, bodyEncoding: 'base64' })).toThrow(
+        /inner\.body/,
+      );
+    },
+  );
+
+  it('refuses non-string header values', () => {
+    expect(() =>
+      validateInnerFrame({ ...okText, body: '', bodyEncoding: 'base64', headers: { 'content-length': 3 } }),
+    ).toThrow(/inner\.headers/);
+  });
+
+  it('refuses a non-object headers map', () => {
+    expect(() =>
+      validateInnerFrame({ ...okText, body: '', bodyEncoding: 'base64', headers: ['content-type'] }),
+    ).toThrow(/inner\.headers/);
+  });
+});
+
+describe('isBase64Body', () => {
+  it('accepts every padding length and the full alphabet', () => {
+    for (const n of [0, 1, 2, 3, 4, 5, 255, 256]) {
+      expect(isBase64Body(toB64(new Uint8Array(n).map((_, i) => i)))).toBe(true);
+    }
+    expect(isBase64Body('+/+/')).toBe(true);
+  });
+
+  it('refuses URL-safe base64, whitespace and bad lengths', () => {
+    expect(isBase64Body('-_-_')).toBe(false);
+    expect(isBase64Body('YW Jj')).toBe(false);
+    expect(isBase64Body('YWJ')).toBe(false);
+  });
+});
+
+const extHello = {
+  type: 'hello',
+  protocolVersion: 4,
+  role: 'extension',
+  platform: 'chrome',
+  extensionId: 'contextmint-bridge',
+  version: '1.8.0',
+  identityX25519Pub: 'AAAA',
+  identityEd25519Pub: 'AAAA',
+  sessionNonce: 'AAAA',
+};
+
+describe('HelloFrameFromExtension.features — validator', () => {
+  it('accepts a hello without it (every extension before #460)', () => {
+    expect(() => validateFrame(extHello)).not.toThrow();
+  });
+
+  it('accepts the list and passes it through', () => {
+    const f = validateFrame({ ...extHello, features: ['fetch_base64'] });
+    expect((f as HelloFrameFromExtension).features).toEqual(['fetch_base64']);
+  });
+
+  it('admits feature names this build does not know — a newer extension must not get its hello refused', () => {
+    expect(() => validateFrame({ ...extHello, features: ['fetch_base64', 'teleport'] })).not.toThrow();
+  });
+
+  it('refuses a non-array, a non-string entry, an empty or overlong entry, and too many entries', () => {
+    expect(() => validateFrame({ ...extHello, features: 'fetch_base64' })).toThrow(/hello\.features/);
+    expect(() => validateFrame({ ...extHello, features: [1] })).toThrow(/hello\.features/);
+    expect(() => validateFrame({ ...extHello, features: [''] })).toThrow(/hello\.features/);
+    expect(() =>
+      validateFrame({ ...extHello, features: ['x'.repeat(MAX_EXTENSION_FEATURE_LENGTH + 1)] }),
+    ).toThrow(/hello\.features/);
+    expect(() =>
+      validateFrame({
+        ...extHello,
+        features: Array.from({ length: MAX_EXTENSION_FEATURES + 1 }, (_, i) => `f${i}`),
+      }),
+    ).toThrow(/hello\.features/);
+  });
+});
+
+describe('extensionFeaturesHelloField', () => {
+  it('is {} for nothing, so a hello with no features keeps its old bytes', () => {
+    expect(extensionFeaturesHelloField([])).toEqual({});
+  });
+
+  it('sorts and de-duplicates', () => {
+    expect(extensionFeaturesHelloField(['fetch_base64', 'fetch_base64'])).toEqual({
+      features: ['fetch_base64'],
+    });
+  });
+
+  it('knows fetch_base64', () => {
+    expect(EXTENSION_FEATURE_FETCH_BASE64).toBe('fetch_base64');
+    expect(KNOWN_EXTENSION_FEATURES.has('fetch_base64')).toBe(true);
+  });
+});
+
+describe('response_too_large', () => {
+  it('starts with the wording every published server already classifies as body_too_large', () => {
+    expect(responseTooLargeMessage({ limitBytes: 100, declaredBytes: 200 })).toMatch(
+      /^response body too large:/,
+    );
+    expect(responseTooLargeMessage({ limitBytes: 100 })).toMatch(/^response body too large:/);
+    expect(RESPONSE_TOO_LARGE_CODE).toBe('response_too_large');
+  });
+
+  it('round-trips the cap and the declared length', () => {
+    expect(parseResponseTooLarge(responseTooLargeMessage({ limitBytes: 100, declaredBytes: 200 }))).toEqual({
+      limitBytes: 100,
+      declaredBytes: 200,
+    });
+    expect(parseResponseTooLarge(responseTooLargeMessage({ limitBytes: 100 }))).toEqual({
+      limitBytes: 100,
+      declaredBytes: null,
+    });
+  });
+
+  it('is null for anything else, including the text-mode wording', () => {
+    expect(parseResponseTooLarge('response body too large: 6000000 bytes')).toBeNull();
+    expect(parseResponseTooLarge('nope')).toBeNull();
+  });
+});
+
+describe('the binary cap fits the transports it crosses', () => {
+  // The largest binary answer a conforming extension can send: the cap's worth
+  // of bytes, a long URL, and every relayed header at a generous length.
+  const worstCase = (): InnerResponseFetchOk => ({
+    type: 'response',
+    id: Number.MAX_SAFE_INTEGER,
+    ok: true,
+    op: 'fetch',
+    status: 200,
+    url: `https://files.example.com/${'a'.repeat(8 * 1024)}`,
+    body: 'A'.repeat(Math.ceil(MAX_BINARY_RESPONSE_BYTES / 3) * 4),
+    bodyEncoding: 'base64',
+    headers: Object.fromEntries(RELAYED_RESPONSE_HEADERS.map((h) => [h, 'x'.repeat(1024)])),
+  });
+  const mcpId = `${'m'.repeat(64)}:1.0.0:${'r'.repeat(16)}`;
+
+  it('is larger than the 5 MiB text cap', () => {
+    expect(MAX_BINARY_RESPONSE_BYTES).toBeGreaterThan(5 * 1024 * 1024);
+  });
+
+  it('seals under MAX_FRAME_BYTES, the cap every receiver enforces', () => {
+    const wire = sealedFrameWireBytes(mcpId, Number.MAX_SAFE_INTEGER, encodeInnerFrame(worstCase()));
+    expect(wire).toBeLessThan(MAX_FRAME_BYTES);
+  });
+
+  it('seals under the hosted relay’s per-message limit, so a hosted download never closes the link', () => {
+    const wire = sealedFrameWireBytes(mcpId, Number.MAX_SAFE_INTEGER, encodeInnerFrame(worstCase()));
+    expect(wire).toBeLessThan(HOSTED_RELAY_MESSAGE_BYTES);
+  });
+
+  it('relays exactly the three headers a server needs before trusting a body', () => {
+    expect([...RELAYED_RESPONSE_HEADERS]).toEqual(['content-type', 'content-length', 'content-disposition']);
+  });
+});
diff --git a/packages/server/README.md b/packages/server/README.md
index 41c10a1e..da030c58 100644
--- a/packages/server/README.md
+++ b/packages/server/README.md
@@ -313,8 +313,30 @@ interface HttpResponse {
 | HTTP status outside `expectStatus` (when set) | Throws `FetchproxyHttpError` with the full `HttpResponse` attached. |
 | Any successful HTTP exchange when no `expectStatus` is set | Resolves; the caller inspects `response.status` themselves. |
 | Programmer error (bad subdomain, undeclared domain, missing capability) | Throws a plain `Error` synchronously at the call site. |
+| The paired extension predates binary fetch (3.7.0+, #460) | `requestBytes()` / `getBytes()` throw `FetchproxyExtensionUpdateRequiredError` (hinted: update ContextMint Bridge) — locally when the extension hello lacks `fetch_base64`, or when the answer comes back without the `bodyEncoding` marker. `fetch()` returns `{ ok: false, kind: 'extension_update_required' }`. |
+| A binary body over the 16 MiB cap (3.7.0+, #460) | Throws `FetchproxyResponseTooLargeError` (`.limitBytes`, `.declaredBytes`). |
 | This browser cannot serve the verb's capability (3.3.0+, #418) | Throws `FetchproxyCapabilityUnavailableError` (a hinted `FetchproxyProtocolError`) — locally when the session listed it, or from the extension's `capability_unavailable` reply. `fetch()` returns `{ ok: false, kind: 'capability_unavailable' }` instead. |
 
+### `await fp.requestBytes(method, path, opts?)` / `fp.getBytes(path, opts?)` — binary downloads (3.7.0+, #460)
+
+The text shortcuts decode the body as UTF-8, which corrupts a PDF, an office file or an image beyond repair. These return the body's **bytes**, intact:
+
+```ts
+const file = await fp.getBytes('https://files.example.com/signed/123?sig=…');
+// { status: 200, url: <final url after redirects>,
+//   headers: { 'content-type': 'application/pdf', 'content-length': '48213',
+//              'content-disposition': 'attachment; filename="report.pdf"' },
+//   bytes: Uint8Array }
+```
+
+- Same path resolution, declared-domain guard, `expectStatus`, `credentials` and error model as `request()`; `inPage` and `viaTab` are not accepted (`BinaryRequestOpts`).
+- The extension runs it from its **background worker**, not a tab, so a file host that sends no CORS headers is readable, and redirects are followed. Both the request URL and the **final** URL must be on the declared `domains` — to read a signed CDN host, declare it (that is a scope change, so the user re-approves once). See `docs/SECURITY.md` §T-binary-fetch for why this does not widen what the extension can reach.
+- Bodies are capped at `MAX_BINARY_RESPONSE_BYTES` (16 MiB, exported) — derived from the hosted relay's 32 MiB message limit. Over it: `FetchproxyResponseTooLargeError`.
+- Needs a ContextMint Bridge build that lists `fetch_base64` in `bridgeHealth().session.features`; otherwise `FetchproxyExtensionUpdateRequiredError`, with no round trip.
+- Only `content-type`, `content-length` and `content-disposition` are relayed, each only when present. Check them before trusting the body.
+
+The low-level equivalent is `fetch({ ...init, responseType: 'base64' })`, whose `ok` envelope then carries `bodyEncoding: 'base64'`, `headers`, and `body` as base64 — but `requestBytes()` also refuses an answer without the marker and re-checks the final URL, so prefer it.
+
 ### `await fp.fetch(init): Promise<FetchResult | FetchResultError>`
 
 The raw, single-shot escape hatch behind the verb shortcuts. Use it when you already have a `FetchInit` ready or need to fully control `tabUrl` independently of the request URL.
diff --git a/packages/server/src/error-kind.ts b/packages/server/src/error-kind.ts
index 0c03be44..e23c9d74 100644
--- a/packages/server/src/error-kind.ts
+++ b/packages/server/src/error-kind.ts
@@ -1,4 +1,8 @@
-import { CAPABILITY_UNAVAILABLE_CODE, parseCapabilityUnavailable } from '@fetchproxy/protocol';
+import {
+  CAPABILITY_UNAVAILABLE_CODE,
+  RESPONSE_TOO_LARGE_CODE,
+  parseCapabilityUnavailable,
+} from '@fetchproxy/protocol';
 
 /**
  * Classifies the raw `error` string the extension puts on the wire
@@ -52,8 +56,14 @@ export type FetchErrorKind =
   | 'capability_unavailable'
   /** Request or response body exceeded the bridge's size cap. The MCP
    * is moving too much data through the per-request frame; consider
-   * a different endpoint or paginating. */
+   * a different endpoint or paginating. #460: also a binary body over
+   * `MAX_BINARY_RESPONSE_BYTES` (wire code `'response_too_large'`). */
   | 'body_too_large'
+  /** #460: the request needs a mode the paired extension does not support
+   * (a binary fetch to a build that predates it). Not produced by
+   * `classifyFetchError` — emitted directly by `FetchproxyServer.fetch()`
+   * when it refuses locally. Fixed by updating the extension. */
+  | 'extension_update_required'
   /** 0.8.0+: server-side `fetchTimeoutMs` fired before the bridge
    * responded. Not produced by `classifyFetchError` — emitted directly
    * by `FetchproxyServer.fetch()` when its own timer wins the race. */
@@ -95,6 +105,7 @@ export function classifyFetchError(
   code?: string,
 ): FetchErrorKind {
   if (code === CAPABILITY_UNAVAILABLE_CODE) return 'capability_unavailable';
+  if (code === RESPONSE_TOO_LARGE_CODE) return 'body_too_large';
   // Checked FIRST: `fetch threw:` means the page's own `fetch()` ran and
   // threw, so the request was attempted in a tab. Its message is whatever the
   // page's error said, and a page error that happens to contain Chrome's
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index bbe49edc..5635e46c 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -4,6 +4,8 @@ export type {
   FetchResult,
   FetchResultError,
   HttpResponse,
+  BinaryResponse,
+  BinaryRequestOpts,
   RequestOpts,
   BodylessRequestOpts,
   FetchCallOpts,
@@ -23,6 +25,8 @@ export {
   FetchproxyTabOpeningError,
   FetchproxyWaitedError,
   FetchproxyCapabilityUnavailableError,
+  FetchproxyExtensionUpdateRequiredError,
+  FetchproxyResponseTooLargeError,
   protocolErrorFrom,
   FetchproxyTimeoutError,
   isRetrySafeOnTimeout,
@@ -74,7 +78,9 @@ export {
 } from './parse-html.js';
 // Batch-paging primitives that pair with the fan-out kit above.
 export { chunk, sleep } from './batch.js';
-export type { Capability, FetchInit, Platform } from '@fetchproxy/protocol';
+export type { Capability, ExtensionFeature, FetchInit, Platform } from '@fetchproxy/protocol';
+// #460: the binary cap, so a consumer can size its own limits against it.
+export { MAX_BINARY_RESPONSE_BYTES } from '@fetchproxy/protocol';
 // #208: the pin an MCP holds on the extension's identity. Exported so a tool
 // (fpx, an MCP's own healthcheck) can show what is pinned and drop one on
 // purpose — a refusal the user cannot inspect or undo is a refusal they will
diff --git a/packages/server/src/session-info.ts b/packages/server/src/session-info.ts
index 81ecadfe..cffacbd3 100644
--- a/packages/server/src/session-info.ts
+++ b/packages/server/src/session-info.ts
@@ -1,5 +1,8 @@
 import {
+  EXTENSION_FEATURE_FETCH_BASE64,
   KNOWN_CAPABILITIES,
+  KNOWN_EXTENSION_FEATURES,
+  type ExtensionFeature,
   type Capability,
   type HelloFrameFromExtension,
   type InnerFrame,
@@ -21,6 +24,13 @@ export interface ExtensionSessionInfo {
   platform: Platform;
   /** Known capability names only, sorted and de-duplicated. */
   unavailableCapabilities: Capability[];
+  /**
+   * #460: the hello's `features`, known names only, sorted and de-duplicated.
+   * Advisory like `unavailableCapabilities`: it only ever makes this MCP
+   * refuse a request locally. What a binary answer is TRUSTED on is its own
+   * `bodyEncoding` marker, never this list.
+   */
+  features: ExtensionFeature[];
 }
 
 export function sessionInfoFromHello(hello: HelloFrameFromExtension): ExtensionSessionInfo {
@@ -32,7 +42,43 @@ export function sessionInfoFromHello(hello: HelloFrameFromExtension): ExtensionS
         known.add(c as Capability);
     }
   }
-  return { platform: hello.platform, unavailableCapabilities: [...known].sort() };
+  const features = new Set<ExtensionFeature>();
+  const rawFeatures: unknown = hello.features;
+  if (Array.isArray(rawFeatures)) {
+    for (const f of rawFeatures) {
+      if (typeof f === 'string' && KNOWN_EXTENSION_FEATURES.has(f as ExtensionFeature))
+        features.add(f as ExtensionFeature);
+    }
+  }
+  return {
+    platform: hello.platform,
+    unavailableCapabilities: [...known].sort(),
+    features: [...features].sort(),
+  };
+}
+
+/**
+ * #460: the extension feature an outbound request needs, or null. Today one:
+ * a `fetch` asking for `responseType: 'base64'` needs `fetch_base64`.
+ */
+export function featureForRequest(inner: InnerFrame): ExtensionFeature | null {
+  if (inner.type !== 'request' || inner.op !== 'fetch') return null;
+  return inner.init.responseType === 'base64' ? EXTENSION_FEATURE_FETCH_BASE64 : null;
+}
+
+/**
+ * #460: the feature `inner` needs that the session's extension did NOT list,
+ * or null. `info === null` (no hello to judge — a peer behind a host too old
+ * to relay it) returns null: the request goes out and the answer's own
+ * `bodyEncoding` marker decides.
+ */
+export function missingFeatureFor(
+  inner: InnerFrame,
+  info: ExtensionSessionInfo | null,
+): ExtensionFeature | null {
+  const feature = featureForRequest(inner);
+  if (feature === null || info === null) return null;
+  return info.features.includes(feature) ? null : feature;
 }
 
 /**
diff --git a/packages/server/src/ws-server.ts b/packages/server/src/ws-server.ts
index d4e54537..086a132f 100644
--- a/packages/server/src/ws-server.ts
+++ b/packages/server/src/ws-server.ts
@@ -9,6 +9,11 @@ import {
   capabilityUnavailableMessage,
   parseCapabilityUnavailable,
   CAPABILITY_UNAVAILABLE_CODE,
+  EXTENSION_FEATURE_FETCH_BASE64,
+  MAX_BINARY_RESPONSE_BYTES,
+  RESPONSE_TOO_LARGE_CODE,
+  isBase64Body,
+  parseResponseTooLarge,
 } from '@fetchproxy/protocol';
 import type {
   Capability,
@@ -23,9 +28,14 @@ import type {
   FetchInit,
   ReadCookiesInitV3,
   DownloadResult,
+  ExtensionFeature,
   Platform,
 } from '@fetchproxy/protocol';
-import { unavailableCapabilityFor, type ExtensionSessionInfo } from './session-info.js';
+import {
+  missingFeatureFor,
+  unavailableCapabilityFor,
+  type ExtensionSessionInfo,
+} from './session-info.js';
 import { electRole } from './election.js';
 import { startHost, type HostHandle } from './host.js';
 import { startPeer, type PeerHandle } from './peer.js';
@@ -466,8 +476,19 @@ export interface FetchResult {
   status: number;
   /** Final URL after redirects, as observed by the browser. */
   url: string;
-  /** Raw response body as a UTF-8 string. */
+  /**
+   * Raw response body as a UTF-8 string — or, when `bodyEncoding` is
+   * `'base64'`, the body's bytes as standard padded base64.
+   */
   body: string;
+  /**
+   * #460: `'base64'` only on the answer to a `responseType: 'base64'`
+   * request, from an extension that honoured it. Absent on a text answer.
+   * `requestBytes()` decodes it for you and refuses an answer without it.
+   */
+  bodyEncoding?: 'base64';
+  /** #460: on a binary answer, the relayed response headers (lower-cased). */
+  headers?: Record<string, string>;
   /**
    * 0.8.0+: true when the server's lazy-revive retry path actually
    * fired for this call (a `content_script_unreachable` first attempt —
@@ -523,10 +544,45 @@ export interface FetchResultError {
    * `pairCode`). `request()` and the verb shortcuts rethrow it unchanged.
    * #418: also set when `kind === 'capability_unavailable'` was decided
    * locally — the `FetchproxyCapabilityUnavailableError` it threw.
+   * #460: and when `kind === 'extension_update_required'` — the
+   * `FetchproxyExtensionUpdateRequiredError` it threw.
    */
   cause?: unknown;
+  /**
+   * #460: the extension's machine-readable `code`, when its refusal carried
+   * one (`'capability_unavailable'`, `'response_too_large'`). Additive; the
+   * `error` string stays the source of truth.
+   */
+  code?: string;
 }
 
+/**
+ * #460: what `requestBytes()` / `getBytes()` resolve with — a response whose
+ * body came through the bridge as BYTES, intact.
+ */
+export interface BinaryResponse {
+  /** Upstream HTTP status code. */
+  status: number;
+  /** Final URL after redirects, as the extension observed it. Inside the declared domains. */
+  url: string;
+  /**
+   * The relayed response headers, lower-cased, each present only when the
+   * response carried it: `content-type`, `content-length`,
+   * `content-disposition`. Check them before trusting the body.
+   */
+  headers: Record<string, string>;
+  /** The response body, byte for byte. At most `MAX_BINARY_RESPONSE_BYTES`. */
+  bytes: Uint8Array;
+}
+
+/**
+ * #460: options for `requestBytes()` / `getBytes()`. `request()`'s options
+ * minus the two that select a TAB: a binary fetch runs from the extension's
+ * background worker, not a page, so `inPage` cannot apply and `viaTab` would
+ * name a relay that is never used.
+ */
+export type BinaryRequestOpts = Omit<RequestOpts, 'inPage' | 'viaTab'>;
+
 /**
  * Public response shape returned by the convenience helpers
  * (`get`/`post`/`request`/…). Strictly the success path — these
@@ -953,6 +1009,70 @@ export class FetchproxyCapabilityUnavailableError extends FetchproxyHintedError
   }
 }
 
+/**
+ * #460: the paired extension cannot serve a mode this request needs — today a
+ * binary fetch (`requestBytes()` / `responseType: 'base64'`) to a ContextMint
+ * Bridge build that predates it.
+ *
+ * Thrown two ways, with the same fields:
+ *
+ * - locally, with no round trip, when the extension's hello did not list the
+ *   feature (`bridgeHealth().session.features`);
+ * - on the answer, when the extension replied to a binary request WITHOUT the
+ *   `bodyEncoding: 'base64'` marker — an older build that ignored the field
+ *   and answered in text. That text is never decoded as bytes.
+ *
+ * Hinted because the remedy is specific and is NOT the MCP's to make: update
+ * the browser extension. Not a pairing problem, not a scope problem.
+ */
+export class FetchproxyExtensionUpdateRequiredError extends FetchproxyHintedError {
+  /** The feature the extension lacks (`'fetch_base64'`). */
+  readonly feature: string;
+
+  constructor(originalError: string, info: { feature: string }) {
+    super(
+      originalError,
+      `this MCP needs the browser extension to support "${info.feature}" (binary ` +
+        `downloads through the bridge), and the ContextMint Bridge build it is paired ` +
+        `with does not. Update ContextMint Bridge (Chrome Web Store / App Store, or ` +
+        `rebuild a sideloaded copy and reload it), then retry. Nothing is wrong with ` +
+        `the MCP or your pairing, and re-pairing will not change it.`,
+    );
+    this.name = 'FetchproxyExtensionUpdateRequiredError';
+    this.feature = info.feature;
+  }
+}
+
+/**
+ * #460: the extension refused a binary body over its size cap
+ * (`MAX_BINARY_RESPONSE_BYTES`), either before reading it (`content-length`
+ * over the cap) or part-way through (no length, or one that lied).
+ *
+ * Mapped from the wire `code: 'response_too_large'` or the fixed wording
+ * `responseTooLargeMessage()`. Hinted for the reason its siblings are: untyped,
+ * it would fall into the CLI's blanket "version mismatch" advice.
+ */
+export class FetchproxyResponseTooLargeError extends FetchproxyHintedError {
+  /** The cap the extension enforced, in bytes, when it said; else `null`. */
+  readonly limitBytes: number | null;
+  /** The response's `content-length`, when the refusal came from it; else `null`. */
+  readonly declaredBytes: number | null;
+
+  constructor(originalError: string, info: { limitBytes: number | null; declaredBytes: number | null }) {
+    const cap = info.limitBytes ?? MAX_BINARY_RESPONSE_BYTES;
+    super(
+      originalError,
+      `the file is larger than the ${cap}-byte cap one bridge response can carry, so the ` +
+        `extension refused it rather than send a frame the bridge cannot deliver. This is ` +
+        `not a version or pairing problem: fetch a smaller rendition if the site offers ` +
+        `one, or download it directly in the browser.`,
+    );
+    this.name = 'FetchproxyResponseTooLargeError';
+    this.limitBytes = info.limitBytes;
+    this.declaredBytes = info.declaredBytes;
+  }
+}
+
 /** Which wait timed out, so the hint can name what would have ended it. */
 export type WaitedOp = 'capture' | 'capture_redirect' | 'download';
 
@@ -1043,6 +1163,15 @@ export function protocolErrorFrom(
       platform: unavailable?.platform ?? null,
     });
   }
+  // #460: a binary body over the cap, recognised by its code (what a later
+  // extension may rely on after rewording) or by the fixed wording.
+  const tooLarge = parseResponseTooLarge(error);
+  if (tooLarge !== null || response?.code === RESPONSE_TOO_LARGE_CODE) {
+    return new FetchproxyResponseTooLargeError(error, {
+      limitBytes: tooLarge?.limitBytes ?? null,
+      declaredBytes: tooLarge?.declaredBytes ?? null,
+    });
+  }
   // Exact, not a substring: 'timeout' is the extension's whole rejection for a
   // closed window. A message that merely CONTAINS the word is some other
   // failure describing itself, and stealing it would be the mis-hint this
@@ -1283,6 +1412,13 @@ export interface BridgeSessionState {
    * §T-unavailable-caps).
    */
   unavailableCapabilities: Capability[];
+  /**
+   * #460: optional behaviours the extension behind the CURRENT session said it
+   * supports — known names only, sorted. `['fetch_base64']` means
+   * `requestBytes()` will be served. Empty when nothing is linked or the
+   * extension predates #460. Advisory, like `unavailableCapabilities`.
+   */
+  features: ExtensionFeature[];
   /** #418: the browser behind the current session (`'chrome'`, `'safari'`, …), or `null` when unlinked. */
   platform: Platform | null;
 }
@@ -1499,6 +1635,23 @@ function assertSubdomainLabel(label: string): void {
  * guards against an absolute URL being passed that escapes the declared
  * domain set.
  */
+/**
+ * `RequestOpts.expectStatus`: throw `FetchproxyHttpError` when the status is
+ * not the one (or one of the ones) asked for. `asHttp` supplies the
+ * `HttpResponse` the error carries, for a response that is not one.
+ */
+function assertExpectedStatus(
+  response: { status: number; url: string },
+  expected: number | number[] | undefined,
+  asHttp: () => HttpResponse = () => response as HttpResponse,
+): void {
+  if (expected === undefined) return;
+  const matched = Array.isArray(expected)
+    ? expected.includes(response.status)
+    : response.status === expected;
+  if (!matched) throw new FetchproxyHttpError(asHttp());
+}
+
 function assertUrlInDomains(field: string, url: string, domains: readonly string[]): void {
   let parsed: URL;
   try {
@@ -2471,6 +2624,17 @@ export class FetchproxyServer {
           cause: err,
         };
       }
+      // #460: refused locally because the extension cannot serve the
+      // request's mode (binary). Nothing was sent.
+      if (err instanceof FetchproxyExtensionUpdateRequiredError) {
+        return {
+          ok: false,
+          error: err.originalError,
+          kind: 'extension_update_required',
+          retryAttempted: false,
+          cause: err,
+        };
+      }
       // B-BUG-13: the frame never reached the bridge, so nothing ran in a
       // tab. Honour fetch()'s envelope contract instead of rejecting, and
       // keep the original error so request() can rethrow it typed.
@@ -2655,7 +2819,17 @@ export class FetchproxyServer {
     if (result.kind === 'capability_unavailable') {
       return protocolErrorFrom(result.error, undefined, { code: CAPABILITY_UNAVAILABLE_CODE, op });
     }
-    return protocolErrorFrom(result.error);
+    if (
+      result.kind === 'extension_update_required' &&
+      result.cause instanceof FetchproxyExtensionUpdateRequiredError
+    ) {
+      return result.cause;
+    }
+    return protocolErrorFrom(
+      result.error,
+      undefined,
+      result.code !== undefined ? { code: result.code, op } : undefined,
+    );
   }
 
   /**
@@ -2680,6 +2854,115 @@ export class FetchproxyServer {
     path: string,
     opts: RequestOpts = {},
   ): Promise<HttpResponse> {
+    const init = this.resolveRequestInit('request', method, path, opts);
+    const result = await this.fetch(
+      init,
+      opts.retryOnTimeout !== undefined ? { retryOnTimeout: opts.retryOnTimeout } : {},
+    );
+    if (!result.ok) this.throwFetchFailure(result, init.url, method, opts.retryOnTimeout);
+    const response: HttpResponse = {
+      status: result.status,
+      body: result.body,
+      url: result.url,
+    };
+    assertExpectedStatus(response, opts.expectStatus);
+    return response;
+  }
+
+  /**
+   * #460: like `request()`, but the response body comes back as BYTES,
+   * intact — a PDF, an office file, an image — together with the relayed
+   * `content-type` / `content-length` / `content-disposition` headers and the
+   * final URL after redirects.
+   *
+   * The extension runs it from its background worker rather than a tab, so a
+   * file host that sends no CORS headers is still readable, and it follows
+   * redirects. Both the request URL and the FINAL URL must be inside the
+   * declared `domains` — the extension enforces that, and so does this method
+   * on the answer. To read a signed file host, declare it.
+   *
+   * Bodies are capped at `MAX_BINARY_RESPONSE_BYTES` (16 MiB): over it the
+   * extension refuses with `FetchproxyResponseTooLargeError`. An extension
+   * that predates binary fetch is refused with
+   * `FetchproxyExtensionUpdateRequiredError` — locally when its hello says so,
+   * and on the answer when it replied in text anyway.
+   */
+  async requestBytes(
+    method: string,
+    path: string,
+    opts: BinaryRequestOpts = {},
+  ): Promise<BinaryResponse> {
+    const init: FetchInit = {
+      ...this.resolveRequestInit('requestBytes', method, path, opts),
+      responseType: 'base64',
+    };
+    const result = await this.fetch(
+      init,
+      opts.retryOnTimeout !== undefined ? { retryOnTimeout: opts.retryOnTimeout } : {},
+    );
+    if (!result.ok) this.throwFetchFailure(result, init.url, method, opts.retryOnTimeout);
+    // The marker, not the hello's advisory `features`, is what the bytes are
+    // trusted on: an older extension ignores `responseType` and answers in
+    // text, and decoding that as base64 would hand back garbage silently.
+    if (result.bodyEncoding !== 'base64') {
+      throw new FetchproxyExtensionUpdateRequiredError(
+        'the paired ContextMint Bridge extension answered a binary request as text',
+        { feature: EXTENSION_FEATURE_FETCH_BASE64 },
+      );
+    }
+    // Belt and braces over the extension's own final-URL check: whatever
+    // relayed this answer, bytes from a host the user never declared are not
+    // handed to the caller.
+    try {
+      assertUrlInDomains('requestBytes final url', result.url, this.opts.domains);
+    } catch (err) {
+      throw new FetchproxyProtocolError((err as Error).message);
+    }
+    // The wire validator already checked this; repeated because `fetch()` is
+    // overridable and Node's decoder skips characters it does not understand.
+    if (!isBase64Body(result.body)) {
+      throw new FetchproxyProtocolError('requestBytes: the extension sent a body that is not base64');
+    }
+    const decoded = Buffer.from(result.body, 'base64');
+    const response: BinaryResponse = {
+      status: result.status,
+      url: result.url,
+      headers: { ...(result.headers ?? {}) },
+      bytes: new Uint8Array(decoded.buffer, decoded.byteOffset, decoded.byteLength),
+    };
+    assertExpectedStatus(response, opts.expectStatus, () => ({
+      status: response.status,
+      url: response.url,
+      // FetchproxyHttpError carries an HttpResponse; a binary body has no
+      // honest text form, so the bytes stay on the BinaryResponse.
+      body: '',
+    }));
+    return response;
+  }
+
+  /** #460: `requestBytes('GET', path, opts)`. */
+  getBytes(path: string, opts: Omit<BinaryRequestOpts, 'body'> = {}): Promise<BinaryResponse> {
+    return this.requestBytes('GET', path, opts);
+  }
+
+  /**
+   * Resolve `path` + options into the wire `FetchInit` — URL building, the
+   * declared-domain guard, the relay tab. Shared by `request()` and
+   * `requestBytes()` so the two can never disagree about which URLs are
+   * reachable.
+   *
+   * Path resolution:
+   *  - Absolute URL (`https://...`) → used as-is (still guarded against
+   *    leaving the declared domain set).
+   *  - Relative path → joined with `https://${subdomain}.${baseDomain}`
+   *    (or `https://${baseDomain}` if no subdomain is given).
+   */
+  private resolveRequestInit(
+    caller: 'request' | 'requestBytes',
+    method: string,
+    path: string,
+    opts: RequestOpts,
+  ): FetchInit {
     if (opts.subdomain !== undefined) assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
     const isAbsolute =
@@ -2698,7 +2981,7 @@ export class FetchproxyServer {
         host = new URL(path).host;
       } catch {
         throw new Error(
-          `FetchproxyServer.request: absolute path is not a valid URL: ${JSON.stringify(path)}`,
+          `FetchproxyServer.${caller}: absolute path is not a valid URL: ${JSON.stringify(path)}`,
         );
       }
     } else {
@@ -2709,7 +2992,7 @@ export class FetchproxyServer {
     // declared domain set. The extension would refuse it anyway; this
     // gives the MCP author a clear error at the call site instead of a
     // generic "domain not allowed" from the bridge.
-    assertUrlInDomains('request url', url, this.opts.domains);
+    assertUrlInDomains(`${caller} url`, url, this.opts.domains);
     // 1.12.0+: `viaTab` overrides which tab relays the request — see
     // RequestOpts.viaTab for why API-only hosts need it. Guarded the same way
     // the request URL is: it changes which page performs the fetch, and that
@@ -2720,13 +3003,13 @@ export class FetchproxyServer {
         new URL(opts.viaTab);
       } catch {
         throw new Error(
-          `FetchproxyServer.request: viaTab is not a valid URL: ${JSON.stringify(opts.viaTab)}`,
+          `FetchproxyServer.${caller}: viaTab is not a valid URL: ${JSON.stringify(opts.viaTab)}`,
         );
       }
       assertUrlInDomains('viaTab', opts.viaTab, this.opts.domains);
       tabUrl = opts.viaTab;
     }
-    const init: FetchInit = {
+    return {
       url,
       method,
       tabUrl,
@@ -2741,49 +3024,37 @@ export class FetchproxyServer {
       // every version before this option existed.
       ...(opts.credentials === 'omit' ? { credentials: 'omit' as const } : {}),
     };
-    const result = await this.fetch(
-      init,
-      opts.retryOnTimeout !== undefined ? { retryOnTimeout: opts.retryOnTimeout } : {},
-    );
-    if (!result.ok) {
-      // B-BUG-13: a local send failure keeps the typed error it always threw.
-      if (result.kind === 'session_not_ready' && result.cause instanceof Error) {
-        throw result.cause;
-      }
-      // #418: a local capability refusal keeps its typed error too.
-      if (
-        result.kind === 'capability_unavailable' &&
-        result.cause instanceof FetchproxyCapabilityUnavailableError
-      ) {
-        throw result.cause;
-      }
-      // retryAttempted rides on the envelope — per-call local context,
-      // so it's race-safe across concurrent calls. Test subclasses
-      // overriding fetch() may not set the field; default to `false`
-      // (the field is declared optional for that reason).
-      throw this._typedErrorFor(
-        result,
-        init.url,
-        'fetch',
-        result.retryAttempted ?? false,
-        isRetrySafeOnTimeout(method, opts.retryOnTimeout),
-      );
+  }
+
+  /** Turn a failed `fetch()` envelope into the throw `request()` has always made. */
+  private throwFetchFailure(
+    result: FetchResultError,
+    url: string,
+    method: string,
+    retryOnTimeout: boolean | undefined,
+  ): never {
+    // B-BUG-13: a local send failure keeps the typed error it always threw.
+    if (result.kind === 'session_not_ready' && result.cause instanceof Error) {
+      throw result.cause;
     }
-    const response: HttpResponse = {
-      status: result.status,
-      body: result.body,
-      url: result.url,
-    };
-    if (opts.expectStatus !== undefined) {
-      const expected = opts.expectStatus;
-      const matched = Array.isArray(expected)
-        ? expected.includes(response.status)
-        : response.status === expected;
-      if (!matched) {
-        throw new FetchproxyHttpError(response);
-      }
+    // #418: a local capability refusal keeps its typed error too.
+    if (
+      result.kind === 'capability_unavailable' &&
+      result.cause instanceof FetchproxyCapabilityUnavailableError
+    ) {
+      throw result.cause;
     }
-    return response;
+    // retryAttempted rides on the envelope — per-call local context,
+    // so it's race-safe across concurrent calls. Test subclasses
+    // overriding fetch() may not set the field; default to `false`
+    // (the field is declared optional for that reason).
+    throw this._typedErrorFor(
+      result,
+      url,
+      'fetch',
+      result.retryAttempted ?? false,
+      isRetrySafeOnTimeout(method, retryOnTimeout),
+    );
   }
 
   /** Issue a GET against `path` (resolved via `request()` rules). */
@@ -3905,6 +4176,10 @@ export class FetchproxyServer {
             status: inner.status,
             url: inner.url,
             body: inner.body,
+            // #460: carried only when present, so a text answer's envelope
+            // has exactly the keys it always had.
+            ...(inner.bodyEncoding !== undefined ? { bodyEncoding: inner.bodyEncoding } : {}),
+            ...(inner.headers !== undefined ? { headers: { ...inner.headers } } : {}),
             retryAttempted: false,
           });
         } else {
@@ -3922,6 +4197,7 @@ export class FetchproxyServer {
           error: inner.error,
           kind: classifyFetchError(inner.error, inner.code),
           retryAttempted: false,
+          ...(inner.code !== undefined ? { code: inner.code } : {}),
         });
       }
       return;
@@ -4281,6 +4557,7 @@ export class FetchproxyServer {
         pairCode,
         extensionConnected: false,
         unavailableCapabilities: [],
+        features: [],
         platform: null,
       };
     }
@@ -4298,6 +4575,7 @@ export class FetchproxyServer {
       pairCode,
       extensionConnected,
       unavailableCapabilities: info ? [...info.unavailableCapabilities] : [],
+      features: info ? [...info.features] : [],
       platform: info?.platform ?? null,
     };
   }
@@ -4312,11 +4590,22 @@ export class FetchproxyServer {
    */
   private refuseIfUnavailable(inner: InnerFrame, info: ExtensionSessionInfo | null): void {
     const cap = unavailableCapabilityFor(inner, info);
-    if (cap === null || info === null) return;
-    throw new FetchproxyCapabilityUnavailableError(
-      capabilityUnavailableMessage(cap, info.platform),
-      { capability: cap, platform: info.platform },
-    );
+    if (cap !== null && info !== null) {
+      throw new FetchproxyCapabilityUnavailableError(
+        capabilityUnavailableMessage(cap, info.platform),
+        { capability: cap, platform: info.platform },
+      );
+    }
+    // #460: a request needing a feature the extension did not advertise —
+    // a binary fetch to an extension that predates it, which would ignore
+    // `responseType` and answer in text. Refused before a seq is claimed.
+    const feature = missingFeatureFor(inner, info);
+    if (feature !== null) {
+      throw new FetchproxyExtensionUpdateRequiredError(
+        `the paired ContextMint Bridge extension does not support "${feature}"`,
+        { feature },
+      );
+    }
   }
 
   /**
diff --git a/packages/server/tests/bridge-session-state.test.ts b/packages/server/tests/bridge-session-state.test.ts
index 4985545a..33009797 100644
--- a/packages/server/tests/bridge-session-state.test.ts
+++ b/packages/server/tests/bridge-session-state.test.ts
@@ -52,6 +52,7 @@ describe('bridgeHealth().session', () => {
       pairCode: null,
       extensionConnected: false,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
   });
@@ -64,6 +65,7 @@ describe('bridgeHealth().session', () => {
       pairCode: null,
       extensionConnected: false,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
   });
@@ -78,6 +80,7 @@ describe('bridgeHealth().session', () => {
       pairCode: null,
       extensionConnected: true,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
   });
@@ -90,6 +93,7 @@ describe('bridgeHealth().session', () => {
       pairCode: '4570-3512',
       extensionConnected: true,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
   });
@@ -118,6 +122,7 @@ describe('bridgeHealth().session', () => {
       pairCode: null,
       extensionConnected: true,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
   });
diff --git a/packages/server/tests/fetch-binary.test.ts b/packages/server/tests/fetch-binary.test.ts
new file mode 100644
index 00000000..54f67bd7
--- /dev/null
+++ b/packages/server/tests/fetch-binary.test.ts
@@ -0,0 +1,352 @@
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  openEncryptedFrame,
+  responseTooLargeMessage,
+  sealInnerFrame,
+  toB64,
+  MAX_BINARY_RESPONSE_BYTES,
+  RESPONSE_TOO_LARGE_CODE,
+  type EncryptedFrame,
+  type InnerFrame,
+  type InnerRequestFetch,
+} from '@fetchproxy/protocol';
+import {
+  FetchproxyServer,
+  FetchproxyExtensionUpdateRequiredError,
+  FetchproxyHintedError,
+  FetchproxyHttpError,
+  FetchproxyProtocolError,
+  FetchproxyResponseTooLargeError,
+  classifyBridgeError,
+  classifyFetchError,
+  protocolErrorFrom,
+} from '../src/index.js';
+import { sessionInfoFromHello } from '../src/session-info.js';
+import { connectMockExtension, type MockExtension } from './helpers/mock-extension.js';
+import { getEphemeralPort } from './helpers/ephemeral-port.js';
+
+/**
+ * #460: `requestBytes()` / `getBytes()` fetch a response's BYTES through the
+ * bridge. The request carries `responseType: 'base64'`; the extension answers
+ * with base64 in `body`, `bodyEncoding: 'base64'` and a relayed header subset.
+ * The server refuses locally when the extension's hello does not list
+ * `fetch_base64`, and refuses any answer that lacks the marker.
+ */
+
+let server: FetchproxyServer | null = null;
+let ext: MockExtension | null = null;
+afterEach(async () => {
+  ext?.close();
+  ext = null;
+  if (server) await server.close();
+  server = null;
+});
+
+const ALL_BYTES = Uint8Array.from({ length: 256 }, (_, i) => i);
+
+async function linked(
+  helloExtra: Parameters<typeof connectMockExtension>[2] = { features: ['fetch_base64'] },
+): Promise<{ server: FetchproxyServer; ext: MockExtension; mcpId: string; key: Uint8Array }> {
+  const port = await getEphemeralPort();
+  const dir = mkdtempSync(join(tmpdir(), 'fp-binary-'));
+  server = new FetchproxyServer({
+    port,
+    serverName: 'files-mcp',
+    version: '1.0.0',
+    domains: ['example.com'],
+    identityDir: dir,
+    trustDir: dir,
+    allowNewExtensionIdentity: true,
+    fetchTimeoutMs: 5_000,
+    bridgeReviveDelayMs: 0,
+    keepAliveIntervalMs: 0,
+  });
+  await server.listen();
+  await server.connect();
+  const mcpId = (server as unknown as { mcpId: string }).mcpId;
+  ext = await connectMockExtension(port, undefined, helloExtra);
+  const key = await ext.completeHandshake(mcpId);
+  await vi.waitFor(() => expect(server!.bridgeHealth().session.state).toBe('linked'));
+  return { server, ext, mcpId, key };
+}
+
+const sentFrames = (e: MockExtension, mcpId: string): EncryptedFrame[] =>
+  e.framesFor(mcpId).filter((f) => f.type === 'frame') as unknown as EncryptedFrame[];
+
+/** Wait for the nth request the server sealed, open it, and return it. */
+async function nextRequest(
+  e: MockExtension,
+  mcpId: string,
+  key: Uint8Array,
+  nth = 0,
+): Promise<InnerRequestFetch> {
+  await vi.waitFor(() => expect(sentFrames(e, mcpId).length).toBeGreaterThan(nth));
+  return (await openEncryptedFrame(key, sentFrames(e, mcpId)[nth]!, 's2e')) as InnerRequestFetch;
+}
+
+let replySeq = 1;
+async function reply(e: MockExtension, mcpId: string, key: Uint8Array, inner: InnerFrame): Promise<void> {
+  e.ws.send(JSON.stringify(await sealInnerFrame(key, mcpId, replySeq++, inner, 'e2s')));
+}
+
+describe('requestBytes — the binary round trip', () => {
+  it('returns all 256 byte values exactly, with status, final url and the relayed headers', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('https://files.example.com/doc/1?sig=abc');
+    const req = await nextRequest(ext, mcpId, key);
+    expect(req.op).toBe('fetch');
+    expect(req.init).toMatchObject({
+      url: 'https://files.example.com/doc/1?sig=abc',
+      method: 'GET',
+      responseType: 'base64',
+    });
+    const headers = {
+      'content-type': 'application/pdf',
+      'content-length': '256',
+      'content-disposition': 'attachment; filename="report.pdf"',
+    };
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 200,
+      url: 'https://files.example.com/doc/1?sig=abc',
+      body: toB64(ALL_BYTES),
+      bodyEncoding: 'base64',
+      headers,
+    });
+    const res = await pending;
+    expect(res.status).toBe(200);
+    expect(res.url).toBe('https://files.example.com/doc/1?sig=abc');
+    expect(res.headers).toEqual(headers);
+    expect(res.bytes).toBeInstanceOf(Uint8Array);
+    expect(res.bytes.length).toBe(256);
+    expect(Array.from(res.bytes)).toEqual(Array.from(ALL_BYTES));
+  });
+
+  it('reports the final url after a redirect, as the extension observed it', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/download/7');
+    const req = await nextRequest(ext, mcpId, key);
+    expect(req.init.url).toBe('https://example.com/download/7');
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 200,
+      url: 'https://files.example.com/signed/7?sig=x',
+      body: toB64(new Uint8Array([0xff, 0x00, 0xfe])),
+      bodyEncoding: 'base64',
+      headers: {},
+    });
+    const res = await pending;
+    expect(res.url).toBe('https://files.example.com/signed/7?sig=x');
+    expect(Array.from(res.bytes)).toEqual([0xff, 0x00, 0xfe]);
+  });
+
+  it('refuses an answer whose final url left the declared domains', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/download/7').catch((e) => e);
+    const req = await nextRequest(ext, mcpId, key);
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 200,
+      url: 'https://elsewhere.example.org/x',
+      body: '',
+      bodyEncoding: 'base64',
+      headers: {},
+    });
+    const err = await pending;
+    expect(err).toBeInstanceOf(FetchproxyProtocolError);
+    expect(err.message).toMatch(/outside declared domains/);
+  });
+
+  it('honours expectStatus with the same FetchproxyHttpError request() throws', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/missing', { expectStatus: 200 }).catch((e) => e);
+    const req = await nextRequest(ext, mcpId, key);
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 404,
+      url: 'https://example.com/missing',
+      body: toB64(new TextEncoder().encode('not found')),
+      bodyEncoding: 'base64',
+      headers: { 'content-type': 'text/plain' },
+    });
+    const err = await pending;
+    expect(err).toBeInstanceOf(FetchproxyHttpError);
+    expect(err.response.status).toBe(404);
+  });
+
+  it('refuses a url outside the declared domains before anything is sent', async () => {
+    const { server, ext, mcpId } = await linked();
+    await expect(server.getBytes('https://bank.example.org/statement.pdf')).rejects.toThrow(
+      /outside declared domains/,
+    );
+    expect(sentFrames(ext, mcpId)).toHaveLength(0);
+  });
+});
+
+describe('text mode is unchanged', () => {
+  it('request() puts no responseType on the wire and returns the body as text', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.get('/page');
+    const req = await nextRequest(ext, mcpId, key);
+    expect(req.init).toEqual({
+      url: 'https://example.com/page',
+      method: 'GET',
+      tabUrl: 'https://example.com/',
+    });
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 200,
+      url: 'https://example.com/page',
+      body: 'héllo',
+    });
+    expect(await pending).toEqual({ status: 200, url: 'https://example.com/page', body: 'héllo' });
+  });
+});
+
+describe('capability negotiation with an older extension', () => {
+  it('reports the advertised features in bridgeHealth()', async () => {
+    const { server } = await linked({ features: ['fetch_base64', 'teleport'] as never });
+    expect(server.bridgeHealth().session.features).toEqual(['fetch_base64']);
+  });
+
+  it('refuses locally, with no round trip, when the extension does not list fetch_base64', async () => {
+    const { server, ext, mcpId } = await linked({});
+    expect(server.bridgeHealth().session.features).toEqual([]);
+    const err = await server.getBytes('/f.pdf').catch((e) => e);
+    expect(err).toBeInstanceOf(FetchproxyExtensionUpdateRequiredError);
+    expect(err).toBeInstanceOf(FetchproxyHintedError);
+    expect(err.feature).toBe('fetch_base64');
+    expect(err.hint).toMatch(/update/i);
+    expect(err.hint).toMatch(/ContextMint Bridge/);
+    expect(classifyBridgeError(err)).toBe('protocol');
+    await new Promise((r) => setTimeout(r, 30));
+    expect(sentFrames(ext, mcpId)).toHaveLength(0);
+  });
+
+  it('the raw fetch() envelope names the kind instead of throwing', async () => {
+    await linked({});
+    const env = await server!.fetch({
+      url: 'https://example.com/f.pdf',
+      method: 'GET',
+      tabUrl: 'https://example.com/',
+      responseType: 'base64',
+    });
+    expect(env.ok).toBe(false);
+    if (!env.ok) expect(env.kind).toBe('extension_update_required');
+  });
+
+  it('refuses an answer with no bodyEncoding marker — an old extension answering as text', async () => {
+    // A relay can ADD `fetch_base64` to the unsigned hello. The older
+    // extension behind it ignores `responseType` and answers in text; that
+    // text must never be decoded as bytes.
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/f.pdf').catch((e) => e);
+    const req = await nextRequest(ext, mcpId, key);
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: true,
+      op: 'fetch',
+      status: 200,
+      url: 'https://example.com/f.pdf',
+      body: '%PDF-1.7 ��',
+    });
+    const err = await pending;
+    expect(err).toBeInstanceOf(FetchproxyExtensionUpdateRequiredError);
+  });
+
+  it('parses only the features it knows from the hello', () => {
+    const info = sessionInfoFromHello({
+      type: 'hello',
+      protocolVersion: 4,
+      role: 'extension',
+      platform: 'chrome',
+      extensionId: 'x',
+      version: '1',
+      identityX25519Pub: 'AAAA',
+      identityEd25519Pub: 'AAAA',
+      sessionNonce: 'AAAA',
+      features: ['teleport', 'fetch_base64', 'fetch_base64'],
+    });
+    expect(info.features).toEqual(['fetch_base64']);
+  });
+});
+
+describe('the size cap', () => {
+  it('maps the early (content-length) refusal to a typed error with both numbers', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/huge.zip').catch((e) => e);
+    const req = await nextRequest(ext, mcpId, key);
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: false,
+      op: 'fetch',
+      code: RESPONSE_TOO_LARGE_CODE,
+      error: responseTooLargeMessage({
+        limitBytes: MAX_BINARY_RESPONSE_BYTES,
+        declaredBytes: 40_000_000,
+      }),
+    });
+    const err = await pending;
+    expect(err).toBeInstanceOf(FetchproxyResponseTooLargeError);
+    expect(err.limitBytes).toBe(MAX_BINARY_RESPONSE_BYTES);
+    expect(err.declaredBytes).toBe(40_000_000);
+    expect(err.hint).not.toMatch(/version mismatch|re-?pair/i);
+  });
+
+  it('maps the streaming refusal (no or lying content-length) too', async () => {
+    replySeq = 1;
+    const { server, ext, mcpId, key } = await linked();
+    const pending = server.getBytes('/huge.zip').catch((e) => e);
+    const req = await nextRequest(ext, mcpId, key);
+    await reply(ext, mcpId, key, {
+      type: 'response',
+      id: req.id,
+      ok: false,
+      op: 'fetch',
+      code: RESPONSE_TOO_LARGE_CODE,
+      error: responseTooLargeMessage({ limitBytes: MAX_BINARY_RESPONSE_BYTES }),
+    });
+    const err = await pending;
+    expect(err).toBeInstanceOf(FetchproxyResponseTooLargeError);
+    expect(err.declaredBytes).toBeNull();
+  });
+
+  it('classifies the wording and the code as body_too_large', () => {
+    const msg = responseTooLargeMessage({ limitBytes: 10, declaredBytes: 20 });
+    expect(classifyFetchError(msg)).toBe('body_too_large');
+    expect(classifyFetchError('reworded', RESPONSE_TOO_LARGE_CODE)).toBe('body_too_large');
+  });
+
+  it('protocolErrorFrom types a coded refusal whose wording it cannot parse', () => {
+    const e = protocolErrorFrom('reworded', undefined, { code: RESPONSE_TOO_LARGE_CODE });
+    expect(e).toBeInstanceOf(FetchproxyResponseTooLargeError);
+    expect((e as FetchproxyResponseTooLargeError).limitBytes).toBeNull();
+  });
+});
diff --git a/packages/server/tests/integration/pair-code-self-derived.test.ts b/packages/server/tests/integration/pair-code-self-derived.test.ts
index 0e5f2136..7f677233 100644
--- a/packages/server/tests/integration/pair-code-self-derived.test.ts
+++ b/packages/server/tests/integration/pair-code-self-derived.test.ts
@@ -566,6 +566,7 @@ describe('a peer judging a pair code it did not receive from our own host (M1)',
       pairCode: null,
       extensionConnected: false,
       unavailableCapabilities: [],
+      features: [],
       platform: null,
     });
 
diff --git a/packages/test-helpers/src/index.ts b/packages/test-helpers/src/index.ts
index 4fc75b19..65794f42 100644
--- a/packages/test-helpers/src/index.ts
+++ b/packages/test-helpers/src/index.ts
@@ -42,6 +42,10 @@ export interface MockFetchproxyServerInstance {
   close: Mock<() => Promise<void>>;
   request: Mock<(...args: unknown[]) => Promise<unknown>>;
   fetch: Mock<(...args: unknown[]) => Promise<unknown>>;
+  /** #460: binary fetch (`{ status, url, headers, bytes }`). */
+  requestBytes: Mock<(...args: unknown[]) => Promise<unknown>>;
+  /** #460: `requestBytes('GET', …)`. */
+  getBytes: Mock<(...args: unknown[]) => Promise<unknown>>;
   captureRequestHeader: Mock<(...args: unknown[]) => Promise<string>>;
   bridgeHealth: Mock<() => unknown>;
 }
@@ -101,6 +105,8 @@ export function createMockFetchproxyServer(): MockFetchproxyServerHelpers {
     close: Mock<() => Promise<void>>;
     request: Mock<(...args: unknown[]) => Promise<unknown>>;
     fetch: Mock<(...args: unknown[]) => Promise<unknown>>;
+    requestBytes: Mock<(...args: unknown[]) => Promise<unknown>>;
+    getBytes: Mock<(...args: unknown[]) => Promise<unknown>>;
     captureRequestHeader: Mock<(...args: unknown[]) => Promise<string>>;
     bridgeHealth: Mock<() => unknown>;
 
@@ -115,6 +121,8 @@ export function createMockFetchproxyServer(): MockFetchproxyServerHelpers {
       this.close = vi.fn(async () => undefined);
       this.request = vi.fn(async () => undefined);
       this.fetch = vi.fn(async () => undefined);
+      this.requestBytes = vi.fn(async () => undefined);
+      this.getBytes = vi.fn(async () => undefined);
       this.captureRequestHeader = vi.fn(async () => '');
       this.bridgeHealth = vi.fn(() => undefined);
       instances.push(this);
@@ -131,6 +139,8 @@ export function createMockFetchproxyServer(): MockFetchproxyServerHelpers {
       inst.close.mockClear();
       inst.request.mockClear();
       inst.fetch.mockClear();
+      inst.requestBytes.mockClear();
+      inst.getBytes.mockClear();
       inst.captureRequestHeader.mockClear();
       inst.bridgeHealth.mockClear();
     }
diff --git a/packages/test-helpers/tests/index.test.ts b/packages/test-helpers/tests/index.test.ts
index 66cb2fb4..2e60b576 100644
--- a/packages/test-helpers/tests/index.test.ts
+++ b/packages/test-helpers/tests/index.test.ts
@@ -264,4 +264,20 @@ describe('vi.mock(@fetchproxy/server) hoisted pattern (README usage)', () => {
     expect(opts?.domains).toEqual(['example.com']);
     expect(opts?.keepAliveIntervalMs).toBe(25_000);
   });
+
+  describe('#460 binary fetch spies', () => {
+    it('exposes requestBytes / getBytes as vi.fn() spies that reset with the rest', async () => {
+      const helpers = createMockFetchproxyServer();
+      const inst = new helpers.MockServer({ serverName: 'x', version: '0', domains: ['example.com'] });
+      expect(vi.isMockFunction(inst.requestBytes)).toBe(true);
+      expect(vi.isMockFunction(inst.getBytes)).toBe(true);
+      const bytes = new Uint8Array([0, 255]);
+      inst.getBytes.mockResolvedValue({ status: 200, url: 'https://example.com/f', headers: {}, bytes });
+      expect(await inst.getBytes('/f')).toMatchObject({ bytes });
+      void inst.requestBytes('GET', '/f');
+      helpers.reset();
+      expect(inst.getBytes).not.toHaveBeenCalled();
+      expect(inst.requestBytes).not.toHaveBeenCalled();
+    });
+  });
 });