diff --git a/NEWS b/NEWS
index 2b01df6..40951ce 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,13 @@
+Hyperflux (unreleased)
+======================
+
+--extract-scan can now find any file type, not just streaming video. By default
+it looks for video and audio; pass --scan-ext=iso,zip,mkv,flac (any extensions,
+any type) to scan for those instead, which also works on a plain directory
+listing. When a page has more than one matching file, flux opens a multi-select
+so you choose which ones go into the generated config.
+
+
 Hyperflux 2.1.0 (2026-06-19)
 ============================
 
diff --git a/README.md b/README.md
index 580bfdb..88c8f0f 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,11 @@ discovery is content-driven: it follows promising links even without a standard
 `/watch` or `/play` pattern, stays within the series you scan, and ignores ad and
 onclick/popunder traps.
 
+By default the scan looks for video and audio. Pass `--scan-ext=iso,zip,mkv,flac`
+to find any file type instead (disk images, archives, anything), which also works
+on a plain directory listing. With more than one file it opens a multi-select so
+you choose which ones go into the config.
+
 The scan prints the config and stashes a pending copy instead of activating it.
 When you are happy with it, run the `flux --save-config <id>` line it suggests to
 install it active. Use `-o FILE` to write straight to a path instead.
diff --git a/src/scan.c b/src/scan.c
index 1a91bd7..df557b9 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -140,27 +140,6 @@ url_host(const char *url)
 	return h;
 }
 
-/* Return the first non-empty path segment of `url` as a malloc'd string, or
- * NULL if none exists (e.g. "https://host/" or no scheme). */
-static char *
-url_first_path_segment(const char *url)
-{
-	if (!url)
-		return NULL;
-	const char *sep = strstr(url, "://");
-	if (!sep)
-		return NULL;
-	const char *path = sep + 3;
-	path += strcspn(path, "/?#");	/* skip authority */
-	if (*path != '/')
-		return NULL;
-	path++;				/* skip leading slash */
-	size_t n = strcspn(path, "/?#");
-	if (n == 0)
-		return NULL;
-	return scan_strndup(path, n);
-}
-
 /* ---- ad-domain blocklist --------------------------------------------- */
 
 /* Small built-in list of ad/tracker hosts; a candidate on (or under) any of
@@ -222,27 +201,77 @@ scan_is_ad_host(const char *host)
 
 /* ---- candidate kind sniff -------------------------------------------- */
 
-/* Classify a media URL by its path extension. Returns 1 for a recognised media
- * URL (kind set), 0 for anything else. */
+/* Default extension table (exts == NULL): video + audio + HLS. HLS extensions
+ * classify as SCAN_KIND_HLS; every other entry is a direct file. The audio set
+ * widens the scan past the old video/HLS-only bias. See #17. */
+static const struct { const char *ext; scan_kind_t kind; } scan_default_exts[] = {
+	{ "m3u8", SCAN_KIND_HLS },
+	{ "m3u",  SCAN_KIND_HLS },
+	/* video */
+	{ "mp4",  SCAN_KIND_FILE },
+	{ "webm", SCAN_KIND_FILE },
+	{ "mkv",  SCAN_KIND_FILE },
+	{ "mov",  SCAN_KIND_FILE },
+	{ "m4v",  SCAN_KIND_FILE },
+	{ "avi",  SCAN_KIND_FILE },
+	{ "flv",  SCAN_KIND_FILE },
+	{ "ts",   SCAN_KIND_FILE },
+	{ "m2ts", SCAN_KIND_FILE },
+	{ "ogv",  SCAN_KIND_FILE },
+	/* audio */
+	{ "mp3",  SCAN_KIND_FILE },
+	{ "flac", SCAN_KIND_FILE },
+	{ "aac",  SCAN_KIND_FILE },
+	{ "opus", SCAN_KIND_FILE },
+	{ "ogg",  SCAN_KIND_FILE },
+	{ "oga",  SCAN_KIND_FILE },
+	{ "wav",  SCAN_KIND_FILE },
+	{ "m4a",  SCAN_KIND_FILE },
+	{ "weba", SCAN_KIND_FILE },
+	{ "wma",  SCAN_KIND_FILE },
+	{ "aiff", SCAN_KIND_FILE },
+	{ "alac", SCAN_KIND_FILE },
+};
+
+/* Classify a media URL by its path extension, using the active extension set
+ * (custom set from the ctx, or the default table when exts == NULL). The custom
+ * set matches ONLY those extensions, all SCAN_KIND_FILE. Match is on the path
+ * before ?# and case-insensitive. Returns 1 for a recognised URL (kind set),
+ * 0 for anything else. Tokens have no leading '.'. */
 static int
-classify_url(const char *url, scan_kind_t *kind)
+classify_url_ext(const char *url, const char *const *exts, size_t nexts,
+		 scan_kind_t *kind)
 {
 	size_t pathlen = strcspn(url, "?#");
 
-	static const struct { const char *ext; scan_kind_t kind; } exts[] = {
-		{ ".m3u8", SCAN_KIND_HLS },
-		{ ".m3u",  SCAN_KIND_HLS },
-		{ ".mp4",  SCAN_KIND_FILE },
-		{ ".webm", SCAN_KIND_FILE },
-		{ ".mkv",  SCAN_KIND_FILE },
-		{ ".mov",  SCAN_KIND_FILE },
-		{ ".m4v",  SCAN_KIND_FILE },
-	};
-	for (size_t i = 0; i < sizeof(exts) / sizeof(exts[0]); i++) {
-		size_t el = strlen(exts[i].ext);
-		if (pathlen >= el &&
-		    strncasecmp(url + pathlen - el, exts[i].ext, el) == 0) {
-			*kind = exts[i].kind;
+	/* Custom set: any matching extension is a plain file. */
+	if (exts) {
+		for (size_t i = 0; i < nexts; i++) {
+			size_t el = strlen(exts[i]);
+			/* Need a '.' immediately before the extension on the path. */
+			if (el == 0 || pathlen < el + 1)
+				continue;
+			if (url[pathlen - el - 1] != '.')
+				continue;
+			if (strncasecmp(url + pathlen - el, exts[i], el) == 0) {
+				*kind = SCAN_KIND_FILE;
+				return 1;
+			}
+		}
+		return 0;
+	}
+
+	/* Default set: video + audio + HLS. */
+	for (size_t i = 0; i < sizeof(scan_default_exts) / sizeof(scan_default_exts[0]);
+	     i++) {
+		size_t el = strlen(scan_default_exts[i].ext);
+		if (pathlen < el + 1)
+			continue;
+		if (url[pathlen - el - 1] != '.')
+			continue;
+		if (strncasecmp(url + pathlen - el, scan_default_exts[i].ext, el)
+		    == 0) {
+			*kind = scan_default_exts[i].kind;
 			return 1;
 		}
 	}
@@ -265,8 +294,19 @@ struct scan_ctx {
 	/* page0 body for the filename-as-param heuristic. Points into caller's
 	 * buffer; NOT owned. NULL outside of discover_chain recursion. */
 	const char *page0_body;
+	/* Optional extension filter (NULL/0 = default video+audio+HLS bias).
+	 * Borrowed from the caller; NOT owned. See #17. */
+	const char *const *exts;
+	size_t nexts;
 };
 
+/* Classify against the ctx's active extension set. */
+static int
+classify_url(struct scan_ctx *ctx, const char *url, scan_kind_t *kind)
+{
+	return classify_url_ext(url, ctx->exts, ctx->nexts, kind);
+}
+
 /* Record `url` as visited; returns 1 if already seen, 0 if newly added/unrecordable.
  * Visited set is best-effort dedup: SCAN_MAX_FETCHES is the real termination bound. */
 static int
@@ -293,12 +333,28 @@ add_candidate(struct scan_ctx *ctx, const char *raw_ref, scan_ctx_t context)
 	if (!raw_ref || !*raw_ref)
 		return 0;
 
+	/* Reject any ref containing control characters (CR, LF, tab, etc.).
+	 * A crafted href with an embedded newline could inject extra directives
+	 * into the emitted config. See #17. */
+	for (const char *p = raw_ref; *p; p++)
+		if (iscntrl((unsigned char)*p))
+			return 0;
+
 	char *url = extractor_resolve_url(ctx->page_url, raw_ref);
 	if (!url)
 		return -1;
 
+	/* Also reject a resolved URL that contains control characters (defensive:
+	 * extractor_resolve_url should never produce one, but be explicit). */
+	for (const char *p = url; *p; p++) {
+		if (iscntrl((unsigned char)*p)) {
+			free(url);
+			return 0;
+		}
+	}
+
 	scan_kind_t kind;
-	if (!classify_url(url, &kind)) {
+	if (!classify_url(ctx, url, &kind)) {
 		free(url);
 		return 0;	/* not a media URL we handle */
 	}
@@ -325,10 +381,20 @@ add_candidate(struct scan_ctx *ctx, const char *raw_ref, scan_ctx_t context)
 		return 0;	/* cap: ignore further candidates */
 	}
 
+	/* Store the raw ref so scan_emit_config_selection can build an alternation
+	 * that matches what is ACTUALLY in the page body (relative hrefs on
+	 * directory listings don't appear as absolute URLs). See #17. */
+	char *rr = scan_strdup(raw_ref);
+	if (!rr) {
+		free(url);
+		return -1;
+	}
+
 	char *host = url_host(url);	/* may be NULL: best effort */
 	scan_candidate_t *c = &r->cands[r->ncands];
 	memset(c, 0, sizeof(*c));
 	c->url = url;
+	c->raw_ref = rr;
 	c->host = host;
 	c->kind = kind;
 	c->context = context;
@@ -415,12 +481,8 @@ static const struct scan_pattern scan_patterns[] = {
 	  SCAN_CTX_PLAYER },
 	{ "[\"']source[\"'][[:space:]]*:[[:space:]]*[\"']([^\"']+)[\"']",
 	  SCAN_CTX_PLAYER },
-	/* Catch-all: any bare media URL in the text (unknown context).
-	 * '&' is excluded from the PATH class so &quot; in HTML-attribute JSON
-	 * doesn't bleed across into a later .mp4, but the optional query/fragment
-	 * allows '&' so signed URLs like ?token=abc&expires=123 are not truncated. */
-	{ "(https?:[^\"'[:space:]<>()&]+\\.(m3u8|mp4|webm)([?#][^\"'[:space:]<>()]*)?)",
-	  SCAN_CTX_UNKNOWN },
+	/* The bare-URL catch-all is built dynamically from the active extension
+	 * set in collect_dynamic_ext (so audio/custom extensions are covered). */
 };
 
 /* The "og:video" two-pattern set captures group 2 in the first variant; to keep
@@ -429,6 +491,89 @@ static const struct scan_pattern scan_patterns[] = {
 static const char *const scan_og_video_ere =
 	"property=[\"']og:video[^\"']*[\"'][^>]*content=[\"']([^\"']+)[\"']";
 
+/* Build an ERE-escaped extension alternation ("mp4|webm|m3u8") from the active
+ * extension set into `dst`. Tokens are alnum so the escape is defensive. The
+ * default set uses scan_default_exts; a custom set uses ctx->exts. Returns the
+ * number of tokens written (0 on an empty/overflowing set). */
+static size_t
+build_ext_alternation(struct scan_ctx *ctx, char *dst, size_t dlen)
+{
+	size_t o = 0, ntok = 0;
+	dst[0] = '\0';
+
+	size_t n = ctx->exts ? ctx->nexts
+		: sizeof(scan_default_exts) / sizeof(scan_default_exts[0]);
+	for (size_t i = 0; i < n; i++) {
+		const char *ext = ctx->exts ? ctx->exts[i]
+					    : scan_default_exts[i].ext;
+		if (!ext || !*ext)
+			continue;
+		if (ntok > 0) {
+			if (o + 1 >= dlen)
+				return 0;
+			dst[o++] = '|';
+		}
+		for (const char *p = ext; *p; p++) {
+			/* ERE-escape metacharacters defensively; {} included so a
+			 * crafted token can't form a brace quantifier. See #17. */
+			if (strchr(".^$*+?()|[]{}\\", *p)) {
+				if (o + 2 >= dlen)
+					return 0;
+				dst[o++] = '\\';
+			}
+			if (o + 1 >= dlen)
+				return 0;
+			dst[o++] = *p;
+		}
+		ntok++;
+	}
+	dst[o] = '\0';
+	return ntok;
+}
+
+/* Build the dynamic capture EREs from the active extension set and run each
+ * over `text`, capturing group 1 as a candidate. Covers a bare-URL catch-all
+ * and href/src catch-alls for directory listings and relative links. Each ERE
+ * is regcomp-verified inside collect_regex; an empty/bad set is skipped.
+ * Returns 0 on success, -1 on OOM. */
+static int
+collect_dynamic_ext(struct scan_ctx *ctx, const char *text)
+{
+	char alt[1024];
+	if (build_ext_alternation(ctx, alt, sizeof(alt)) == 0)
+		return 0;	/* empty/overflowing set: nothing to do */
+
+	/* Bare-URL catch-all: '&' excluded from the PATH class (so &quot; in
+	 * attribute JSON doesn't bleed), allowed in the optional query tail. The
+	 * URL is group 1. See #17 / FIX from #scan FIX C. */
+	char bare[1200];
+	int n = snprintf(bare, sizeof(bare),
+		"(https?:[^\"'[:space:]<>()&]+\\.(%s)([?#][^\"'[:space:]<>()]*)?)",
+		alt);
+	if (n > 0 && (size_t)n < sizeof(bare))
+		if (collect_regex(ctx, text, bare, SCAN_CTX_UNKNOWN) < 0)
+			return -1;
+
+	/* href/src catch-alls for directory listings and relative links. POSIX
+	 * ERE has no non-capturing group, so use two patterns each with the URL
+	 * as group 1; add_candidate resolves relative -> absolute. */
+	char href_ere[1200];
+	n = snprintf(href_ere, sizeof(href_ere),
+		     "href=[\"']([^\"'<>]+\\.(%s))[\"']", alt);
+	if (n > 0 && (size_t)n < sizeof(href_ere))
+		if (collect_regex(ctx, text, href_ere, SCAN_CTX_UNKNOWN) < 0)
+			return -1;
+
+	char src_ere[1200];
+	n = snprintf(src_ere, sizeof(src_ere),
+		     "src=[\"']([^\"'<>]+\\.(%s))[\"']", alt);
+	if (n > 0 && (size_t)n < sizeof(src_ere))
+		if (collect_regex(ctx, text, src_ere, SCAN_CTX_UNKNOWN) < 0)
+			return -1;
+
+	return 0;
+}
+
 /* Find same-origin <iframe src="URL"> targets in `text`, fetch each, and
  * re-scan its body for candidates (one level deep). Returns 0 or -1. */
 static int
@@ -447,6 +592,9 @@ collect_patterns(struct scan_ctx *ctx, const char *text)
 			return -1;
 	if (collect_regex(ctx, text, scan_og_video_ere, SCAN_CTX_PLAYER) < 0)
 		return -1;
+	/* Dynamic bare-URL + href/src catch-alls from the active ext set. */
+	if (collect_dynamic_ext(ctx, text) < 0)
+		return -1;
 	if (collect_gdrive(ctx, text) < 0)
 		return -1;
 	return 0;
@@ -1490,7 +1638,7 @@ discover_chain(struct scan_ctx *ctx, const char *body, scan_step_t *steps,
 			return -1;
 		}
 		scan_kind_t kind;
-		if (classify_url(media_url, &kind) && nsteps < SCAN_MAX_CHAIN) {
+		if (classify_url(ctx, media_url, &kind) && nsteps < SCAN_MAX_CHAIN) {
 			steps[nsteps].ere = (char *)scan_chain_media_eres[mi];
 			steps[nsteps].sample = media_url;
 			int ar = add_chain_candidate(ctx, media_url, kind,
@@ -2123,10 +2271,13 @@ sort_candidates(scan_result_t *r)
 /* If the landing page has >= SCAN_SERIES_MIN direct-media candidates that share
  * a numeric template (maximal [0-9]+ runs replaced with '#'), mark the result
  * as a media-list series and build list_ere from the dominant extension.
- * Also handles GDrive series (no numeric template required).
+ * Also handles GDrive series (no numeric template required). `body` is the
+ * landing page text, used to anchor the list ERE: absolute URLs present in the
+ * body use a bare-URL ERE; relative refs (directory listings) use a quoted-ref
+ * ERE the extractor resolves relative->absolute. See #17.
  * Returns 0 on success, -1 on OOM. No-op when is_series already set. */
 static int
-detect_direct_media_series(scan_result_t *r)
+detect_direct_media_series(scan_result_t *r, const char *body)
 {
 	if (r->is_series || r->ncands < SCAN_SERIES_MIN)
 		return 0;
@@ -2203,8 +2354,51 @@ detect_direct_media_series(scan_result_t *r)
 			best_ti  = i;
 		}
 	}
-	if (best_cnt < SCAN_SERIES_MIN)
-		return 0;
+	if (best_cnt < SCAN_SERIES_MIN) {
+		/* Numeric-template grouping failed. Fall back to extension-based
+		 * grouping: count candidates sharing the most common extension.
+		 * Covers mixed-distro autoindex pages (ubuntu-24.04.iso +
+		 * debian-12.iso) and any custom --scan-ext set. See #17. */
+		const char *best_ext = NULL;
+		size_t best_ecnt = 0;
+		for (size_t i = 0; i < r->ncands; i++) {
+			size_t plen = strcspn(r->cands[i].url, "?#");
+			const char *dot = NULL;
+			/* Find last '.' in the path portion. */
+			for (size_t k = 0; k < plen; k++)
+				if (r->cands[i].url[k] == '.')
+					dot = r->cands[i].url + k;
+			if (!dot || dot[1] == '\0')
+				continue;
+			const char *this_ext = dot + 1;
+			/* Count how many candidates share this extension (case-insensitive,
+			 * path only, no query/fragment). */
+			size_t ecnt = 0;
+			for (size_t j = 0; j < r->ncands; j++) {
+				size_t plen2 = strcspn(r->cands[j].url, "?#");
+				const char *dot2 = NULL;
+				for (size_t k = 0; k < plen2; k++)
+					if (r->cands[j].url[k] == '.')
+						dot2 = r->cands[j].url + k;
+				if (!dot2 || dot2[1] == '\0')
+					continue;
+				size_t elen = strcspn(this_ext, "?#");
+				size_t elen2 = strlen(dot2 + 1);
+				if (elen == elen2 &&
+				    strncasecmp(this_ext, dot2 + 1, elen) == 0)
+					ecnt++;
+			}
+			if (ecnt > best_ecnt) {
+				best_ecnt = ecnt;
+				best_ext  = this_ext;
+				best_ti   = i;
+			}
+		}
+		if (best_ecnt < SCAN_SERIES_MIN || !best_ext)
+			return 0;
+		/* best_ti now points to the representative candidate for the dominant
+		 * extension; fall through to the ERE-building block below. */
+	}
 
 	/* Detect the file extension from the dominant template's representative
 	 * URL (e.g. "mp4"). Strip query/fragment first so strrchr('.') doesn't
@@ -2223,16 +2417,47 @@ detect_direct_media_series(scan_result_t *r)
 		return 0;
 	const char *ext = dot + 1;
 
-	/* Build ERE: (https?:[^"'<> &]+\.<ext>([?#][^"'<> ]*)?).
-	 * POSIX ERE, one capture group, no braces, regcomp-verified before storing.
-	 * The optional query tail reuses the catch-all shape so signed URLs with
-	 * &-separated params are captured in full. */
-	char ere[160];
-	int n = snprintf(ere, sizeof(ere),
-			 "(https?:[^\"'<> &]+\\.%s([?#][^\"'<> ]*)?)", ext);
-	if (n <= 0 || (size_t)n >= sizeof(ere))
+	/* ERE-escape the extension token defensively; include {} so a brace
+	 * quantifier can't slip through. See #17. */
+	char ext_ere[80];
+	size_t eo = 0;
+	for (const char *p = ext; *p && eo + 2 < sizeof(ext_ere); p++) {
+		if (strchr(".^$*+?()|[]{}\\", *p))
+			ext_ere[eo++] = '\\';
+		ext_ere[eo++] = *p;
+	}
+	ext_ere[eo] = '\0';
+
+	/* Anchor the list ERE: prefer the bare-URL catch-all when a bare
+	 * https?: URL of this extension is present in the page body (JSON-embedded
+	 * media, signed URLs, autoindex with absolute links). When it is not (a
+	 * directory listing whose <a href> are relative refs), match a quoted ref
+	 * the extractor resolves relative->absolute. Both: one capture group, no
+	 * braces, regcomp-verified. See #17. */
+	char bare_ere[200];
+	int n = snprintf(bare_ere, sizeof(bare_ere),
+			 "(https?:[^\"'<> &]+\\.%s([?#][^\"'<> ]*)?)", ext_ere);
+	if (n <= 0 || (size_t)n >= sizeof(bare_ere))
 		return 0;
 
+	int bare_matches = 0;
+	regex_t bre;
+	if (regcomp(&bre, bare_ere, REG_EXTENDED | REG_ICASE) != 0)
+		return 0;
+	if (body && regexec(&bre, body, 0, NULL, 0) == 0)
+		bare_matches = 1;
+	regfree(&bre);
+
+	char ere[200];
+	if (bare_matches)
+		memcpy(ere, bare_ere, strlen(bare_ere) + 1);
+	else {
+		n = snprintf(ere, sizeof(ere),
+			     "[\"']([^\"'<>]+\\.%s)[\"']", ext_ere);
+		if (n <= 0 || (size_t)n >= sizeof(ere))
+			return 0;
+	}
+
 	regex_t re;
 	if (regcomp(&re, ere, REG_EXTENDED | REG_ICASE) != 0)
 		return 0;
@@ -2253,7 +2478,8 @@ detect_direct_media_series(scan_result_t *r)
 
 scan_result_t *
 scan_page(const char *page_url, extractor_fetch_fn fetch, scan_probe_fn probe,
-	  int max_depth, void *userdata, char **err)
+	  int max_depth, const char *const *exts, size_t nexts,
+	  void *userdata, char **err)
 {
 	if (err)
 		*err = NULL;
@@ -2300,6 +2526,8 @@ scan_page(const char *page_url, extractor_fetch_fn fetch, scan_probe_fn probe,
 	ctx.fetch = fetch;
 	ctx.probe = probe;
 	ctx.userdata = userdata;
+	ctx.exts = exts;		/* NULL/0 = default video+audio+HLS bias */
+	ctx.nexts = nexts;
 	scan_visited(&ctx, page_url);	/* the landing page counts as visited */
 	ctx.nfetches = 1;		/* landing page already fetched above */
 
@@ -2325,7 +2553,6 @@ scan_page(const char *page_url, extractor_fetch_fn fetch, scan_probe_fn probe,
 			return NULL;
 		}
 	}
-	free(body);
 	for (size_t i = 0; i < ctx.nvisited; i++)
 		free(ctx.visited[i]);
 	ctx.nvisited = 0; /* prevent double-free if detect_direct_media_series OOMs */
@@ -2349,7 +2576,8 @@ scan_page(const char *page_url, extractor_fetch_fn fetch, scan_probe_fn probe,
 
 	/* Promote direct multi-episode pages (all URLs in the page, numeric
 	 * template) to a media-list series so emit generates a list config. */
-	if (detect_direct_media_series(r) < 0) {
+	if (detect_direct_media_series(r, body) < 0) {
+		free(body);
 		for (size_t i = 0; i < ctx.nvisited; i++)
 			free(ctx.visited[i]);
 		scan_set_err(err, "out of memory while scanning page");
@@ -2357,6 +2585,7 @@ scan_page(const char *page_url, extractor_fetch_fn fetch, scan_probe_fn probe,
 		return NULL;
 	}
 
+	free(body);
 	return r;
 }
 
@@ -2370,6 +2599,7 @@ scan_result_free(scan_result_t *r)
 	free(r->series_path);
 	for (size_t i = 0; i < r->ncands; i++) {
 		free(r->cands[i].url);
+		free(r->cands[i].raw_ref);
 		free(r->cands[i].host);
 		free(r->cands[i].param_token);
 		free(r->cands[i].media_base);
@@ -2469,7 +2699,8 @@ derive_name(const char *host, char *dst, size_t len)
 }
 
 /* Build a 'match' ERE from the page host: escape dots so the regex is literal
- * on the host (e.g. animeworld\.ac). Writes into dst (NUL-terminated). */
+ * on the host, then append (:[0-9]+)? so a port in the real URL doesn't break
+ * the match (e.g. 127.0.0.1:8080/...). Writes into dst (NUL-terminated). */
 static void
 derive_match(const char *host, char *dst, size_t len)
 {
@@ -2483,9 +2714,43 @@ derive_match(const char *host, char *dst, size_t len)
 			dst[o++] = '\\';
 		dst[o++] = *p;
 	}
+	/* Optional :port — local servers and non-standard ports need this. */
+	static const char port_tok[] = "(:[0-9]+)?";
+	if (o + sizeof(port_tok) < len) {
+		memcpy(dst + o, port_tok, sizeof(port_tok)); /* includes NUL */
+		o += sizeof(port_tok) - 1;
+	}
 	dst[o] = '\0';
 }
 
+/* Return the directory portion of `url`'s path as a malloc'd string: everything
+ * from the first '/' after the authority up to and including the last '/'.
+ * For "http://host:8080/isos/index.html" returns "/isos/".
+ * For "http://host/index.html" returns "/".
+ * Returns NULL if `url` has no scheme, or on OOM. */
+static char *
+url_dir_path(const char *url)
+{
+	if (!url)
+		return NULL;
+	const char *sep = strstr(url, "://");
+	if (!sep)
+		return NULL;
+	const char *auth = sep + 3;
+	const char *path = auth + strcspn(auth, "/?#");
+	if (*path != '/')
+		return scan_strdup("/");
+	/* Find the last '/' in the path (before any '?' or '#'). */
+	const char *pathend = path + strcspn(path, "?#");
+	const char *last_slash = path;
+	for (const char *p = path; p < pathend; p++)
+		if (*p == '/')
+			last_slash = p;
+	/* Include the last slash in the result. */
+	size_t n = (size_t)(last_slash - path) + 1;
+	return scan_strndup(path, n);
+}
+
 /* Resolve which candidate to emit: an explicit index, or the top-ranked one.
  * Returns the candidate pointer, or NULL if the list is empty/out of range. */
 static const scan_candidate_t *
@@ -2618,14 +2883,14 @@ scan_emit_config(const scan_result_t *r, int chosen, FILE *out)
 	char match[256];
 	derive_name(host, name, sizeof(name));
 	derive_match(host, match, sizeof(match));
-	/* For series, tighten match from the LANDING page path so extractor_matches
-	 * fires on the series index URL, not on episode URLs. See #scan-series-match. */
+	/* For series, tighten match to the landing page's directory so
+	 * extractor_matches fires on the listing URL (including :port) but not on
+	 * individual file URLs under a different path. See #scan-series-match. */
 	if (r->is_series) {
-		char *seg = url_first_path_segment(r->page_url);
-		if (seg) {
-			match_append_path(match, sizeof(match), "/");
-			match_append_path(match, sizeof(match), seg);
-			free(seg);
+		char *dir = url_dir_path(r->page_url);
+		if (dir) {
+			match_append_path(match, sizeof(match), dir);
+			free(dir);
 		}
 	} else if (r->series_path) {
 		match_append_path(match, sizeof(match), r->series_path);
@@ -2745,6 +3010,159 @@ scan_emit_config(const scan_result_t *r, int chosen, FILE *out)
 	return 0;
 }
 
+/* ERE-escape an absolute URL into `dst` so it matches literally inside an
+ * alternation branch. Returns 0 on success, -1 if it would overflow. */
+static int
+ere_escape_url(const char *url, char *dst, size_t dlen)
+{
+	size_t o = 0;
+	for (const char *p = url; *p; p++) {
+		if (strchr(".^$*+?()|[]{}\\", *p)) {
+			if (o + 2 >= dlen)
+				return -1;
+			dst[o++] = '\\';
+		}
+		if (o + 1 >= dlen)
+			return -1;
+		dst[o++] = *p;
+	}
+	dst[o] = '\0';
+	return 0;
+}
+
+int
+scan_emit_config_selection(const scan_result_t *r, const size_t *sel,
+			   size_t nsel, FILE *out)
+{
+	if (!r || !out || !sel || nsel == 0)
+		return -1;
+	for (size_t i = 0; i < nsel; i++)
+		if (sel[i] >= r->ncands)
+			return -1;	/* out-of-range index */
+
+	/* A single chosen file: emit a static output directly, bypassing the
+	 * series list path (the user picked exactly one file). See #17. */
+	if (nsel == 1) {
+		const scan_candidate_t *c = &r->cands[sel[0]];
+		char *host = url_host(r->page_url);
+		char name[128];
+		char match[256];
+		derive_name(host, name, sizeof(name));
+		derive_match(host, match, sizeof(match));
+		/* Anchor to the landing directory (covers :port). */
+		char *dir1 = url_dir_path(r->page_url);
+		if (dir1) {
+			match_append_path(match, sizeof(match), dir1);
+			free(dir1);
+		}
+		fprintf(out, "# Hyperflux extractor config (generated by --extract-scan)\n");
+		fprintf(out, "# Source page: %s\n", r->page_url);
+		fprintf(out, "# Review and edit before use: a config issues HTTP requests\n");
+		fprintf(out, "# with arbitrary headers. Treat shared configs like scripts.\n");
+		fprintf(out, "\n");
+		fprintf(out, "name   %s\n", name);
+		fprintf(out, "match  %s\n", match);
+		fprintf(out, "\n");
+		fprintf(out, "output %s\n", c->url);
+		free(host);
+		return 0;
+	}
+
+	/* Reuse the series machinery's live list_ere when the selection is every
+	 * candidate and a list_ere already roundtrips (covers directory listings
+	 * and JSON-embedded absolute-URL pages). */
+	int all_selected = (nsel == r->ncands);
+	if (all_selected && r->is_series && r->list_ere)
+		return scan_emit_config(r, -1, out);
+
+	/* Emit an exact alternation that matches what is ACTUALLY in the page
+	 * body. On directory listings the body has relative hrefs ("file.iso"),
+	 * not absolute URLs, so the alternation must be built from raw_ref (the
+	 * captured text before resolve). Fall back to the absolute URL only when
+	 * raw_ref is NULL (shouldn't happen for direct candidates) or when it
+	 * already looks absolute (starts with a scheme). The alternation is
+	 * wrapped as ["'](branch1|branch2)["'] so group 1 matches the href value,
+	 * exactly as the per-extension catch-all ERE does. POSIX-ERE, one capture
+	 * group, regcomp-verified. See #17. */
+	char *alt = NULL;
+	size_t acap = 0;
+	FILE *ap = open_memstream(&alt, &acap);
+	if (!ap)
+		return -1;
+	/* Determine whether to wrap in quotes (relative refs) or use a bare-URL
+	 * form (absolute URLs). Use the first selected candidate's raw_ref as
+	 * the signal: if it looks absolute (has "://"), all selected candidates
+	 * are likely absolute too, so use the bare-URL form without quotes. */
+	const char *first_raw = r->cands[sel[0]].raw_ref;
+	int use_quotes = !(first_raw && strstr(first_raw, "://"));
+	int oom = 0;
+	if (use_quotes)
+		oom = (fputs("[\"'](", ap) == EOF);
+	else
+		oom = (fputc('(', ap) == EOF);
+	for (size_t i = 0; i < nsel && !oom; i++) {
+		const scan_candidate_t *cand = &r->cands[sel[i]];
+		/* Pick the string that will appear in the page body. */
+		const char *ref = (cand->raw_ref && *cand->raw_ref)
+			? cand->raw_ref : cand->url;
+		char esc[2048];
+		if (ere_escape_url(ref, esc, sizeof(esc)) != 0) {
+			oom = 1;	/* ref too long for the buffer: bail */
+			break;
+		}
+		if (i > 0)
+			fputc('|', ap);
+		fputs(esc, ap);
+	}
+	if (!oom) {
+		if (use_quotes)
+			oom = (fputs(")[\"']", ap) == EOF);
+		else
+			oom = (fputc(')', ap) == EOF);
+	}
+	if (fclose(ap) != 0 || oom || !alt) {
+		free(alt);
+		return -1;
+	}
+
+	/* Verify the alternation compiles cleanly before emitting it. */
+	regex_t re;
+	if (regcomp(&re, alt, REG_EXTENDED) != 0) {
+		free(alt);
+		return -1;
+	}
+	regfree(&re);
+
+	char *host = url_host(r->page_url);
+	char name[128];
+	char match[256];
+	derive_name(host, name, sizeof(name));
+	derive_match(host, match, sizeof(match));
+	/* Anchor match to the landing directory so :port URLs are covered. */
+	char *dir = url_dir_path(r->page_url);
+	if (dir) {
+		match_append_path(match, sizeof(match), dir);
+		free(dir);
+	}
+
+	fprintf(out, "# Hyperflux extractor config (generated by --extract-scan)\n");
+	fprintf(out, "# Source page: %s\n", r->page_url);
+	fprintf(out, "# Review and edit before use: a config issues HTTP requests\n");
+	fprintf(out, "# with arbitrary headers. Treat shared configs like scripts.\n");
+	fprintf(out, "\n");
+	fprintf(out, "name   %s\n", name);
+	fprintf(out, "match  %s\n", match);
+	fprintf(out, "\n");
+	fprintf(out, "# %zu files selected from the scan; lists exactly those.\n", nsel);
+	fprintf(out, "get    page <- {url}\n");
+	fprintf(out, "list   eps  <- page regex %s\n", alt);
+	fprintf(out, "output {url}\n");
+
+	free(host);
+	free(alt);
+	return 0;
+}
+
 int
 scan_config_name(const scan_result_t *r, char *dst, size_t len)
 {
diff --git a/src/scan.h b/src/scan.h
index d3c72be..d41891c 100644
--- a/src/scan.h
+++ b/src/scan.h
@@ -90,6 +90,9 @@ typedef struct {
 /* One scored media candidate. */
 typedef struct {
 	char *url;		/* resolved absolute media URL (owned) */
+	char *raw_ref;		/* the ref exactly as captured from the page body (owned); used by
+				 * scan_emit_config_selection to build an alternation that matches the
+				 * page body (relative hrefs don't appear as absolute URLs). */
 	char *host;		/* host of url (owned), for the blocklist/uniqueness */
 	scan_kind_t kind;
 	scan_ctx_t context;
@@ -136,12 +139,18 @@ typedef int (*scan_probe_fn)(const char *url, long long *out_size,
  * chain that leads to it (so a multi-step config can be generated). It also
  * detects series index pages. `max_depth == 0` disables recursion.
  *
+ * `exts`/`nexts` is an optional extension filter (NULL/0 = default media bias:
+ * video + audio + HLS). When non-NULL, only those extensions are recognised,
+ * all classified SCAN_KIND_FILE, so any file type (archives, disk images,
+ * documents, ...) can be discovered on directory-listing pages. See #17.
+ *
  * On success returns a malloc'd scan_result_t (free with scan_result_free) with
  * a scored, ranked candidate list and *err left NULL. On failure returns NULL
  * and, if err is non-NULL, sets *err to a malloc'd message the caller frees.
  * A page that yields no candidates is a success with ncands == 0. */
 scan_result_t *scan_page(const char *page_url, extractor_fetch_fn fetch,
 			 scan_probe_fn probe, int max_depth,
+			 const char *const *exts, size_t nexts,
 			 void *userdata, char **err);
 
 void scan_result_free(scan_result_t *r);
@@ -158,6 +167,17 @@ int scan_is_ad_host(const char *host);
  * Returns 0 on success, negative on a write/argument error. */
 int scan_emit_config(const scan_result_t *r, int chosen, FILE *out);
 
+/* Emit a `list` config that resolves EXACTLY the candidates in `sel`
+ * (`nsel` 0-based indices into r->cands). Used after a multi-select TUI so the
+ * generated config includes only the chosen files. When the selection is a
+ * single candidate, a single-output config is written (same shape as the
+ * chosen-index scan_emit_config path). With 2+ selected files an ERE-escaped
+ * alternation of their absolute URLs drives a `list` directive. The ERE is
+ * regcomp-verified with exactly one capture group. Returns 0 on success,
+ * negative on a write/argument/regex error. */
+int scan_emit_config_selection(const scan_result_t *r, const size_t *sel,
+			       size_t nsel, FILE *out);
+
 /* Derive the host-based config name scan_emit_config writes (e.g.
  * www.animeworld.ac -> "animeworld"), used to build the default save filename
  * <name>.conf. Writes a NUL-terminated name into `dst`. Returns 0 on success,
diff --git a/src/test_scan.c b/src/test_scan.c
index 709321c..6de5bae 100644
--- a/src/test_scan.c
+++ b/src/test_scan.c
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <ctype.h>
 
 #include "scan.h"
 
@@ -122,7 +123,8 @@ test_direct_source(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(a) direct-source page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -177,7 +179,8 @@ test_hls_in_json(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(b) HLS-in-JSON page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -240,7 +243,8 @@ test_ad_vs_content(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(c) ad-vs-content page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -296,7 +300,8 @@ test_skeleton_when_no_media(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(d) animeworld-like page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -340,7 +345,8 @@ test_one_hop(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(e) one-hop page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -416,7 +422,8 @@ test_two_hops(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(f) two-hop page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -493,7 +500,8 @@ test_series(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(g) series page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -575,7 +583,8 @@ test_series_no_media(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(g2) series-no-media page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -621,7 +630,8 @@ test_generic_link_follow(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(h) generic-link page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -702,7 +712,8 @@ test_structural_series(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(i) structural series page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -804,7 +815,8 @@ test_multi_series_containment(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(j) multi-series page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -893,7 +905,8 @@ test_multi_series_absolute(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(l) absolute-href multi-series scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -957,7 +970,8 @@ test_ad_trap(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(k) ad-trap page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -1029,7 +1043,8 @@ test_kissanime_shape(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(m) kissanime page scans");
 	if (!r) { printf("  err: %s\n", err ? err : "(none)"); free(err); return; }
 
@@ -1161,7 +1176,8 @@ test_filename_as_param(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(n) filename-as-param page scans");
 	if (!r) {
 		printf("  err: %s\n", err ? err : "(none)");
@@ -1269,7 +1285,8 @@ test_animeunity_json_attr(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(o) AnimeUnity-shaped page scans");
 	if (!r) {
 		printf("  err: %s\n", err ? err : "(none)");
@@ -1375,7 +1392,8 @@ test_gdrive_series(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(p) GDrive series page scans");
 	if (!r) {
 		printf("  err: %s\n", err ? err : "(none)");
@@ -1470,7 +1488,8 @@ test_gdrive_single(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(p-single) GDrive single page scans");
 	if (!r) {
 		printf("  err: %s\n", err ? err : "(none)");
@@ -1528,7 +1547,8 @@ test_episode_number_conservative(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages_kiss[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site_kiss, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site_kiss, &err);
 	CHECK(r != NULL, "(ep-num) kissanime fixture scans");
 	CHECK(r && r->is_series, "(ep-num) kissanime is series");
 	free(err);
@@ -1555,7 +1575,8 @@ test_episode_number_conservative(void)
 
 	char *err2 = NULL;
 	scan_result_t *r2 = scan_page(pages_aw[0].url, fake_fetch, fake_probe,
-				      SCAN_DEFAULT_DEPTH, &site_aw, &err2);
+				      SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site_aw, &err2);
 	CHECK(r2 != NULL, "(ep-num) AnimeWorld fixture scans");
 	/* AnimeWorld's opaque epids (JyaFP, sWi1hA) don't match the episode
 	 * URL patterns, so detect_series falls back to generic detection.
@@ -1583,7 +1604,8 @@ test_skeleton_shape(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     0 /* no recursion */, &site, &err);
+				     0 /* no recursion */, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(skel) skeleton page scans");
 	free(err);
 	if (!r) return;
@@ -1639,7 +1661,8 @@ test_episode_ordering(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(ep-ord) ordering fixture scans");
 	free(err);
 	if (!r) return;
@@ -1708,7 +1731,8 @@ test_catchall_signed_url(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     0, &site, &err);
+				     0, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(signed-url) page scans");
 	free(err);
 	if (!r) return;
@@ -1733,7 +1757,8 @@ test_catchall_signed_url(void)
 
 	char *err2 = NULL;
 	scan_result_t *r2 = scan_page(pages2[0].url, fake_fetch, fake_probe,
-				      0, &site2, &err2);
+				      0, NULL, 0,
+				     &site2, &err2);
 	CHECK(r2 != NULL, "(signed-url) animeunity page scans");
 	free(err2);
 	if (!r2) return;
@@ -1765,7 +1790,8 @@ test_gdrive_filed_series(void)
 
 	char *err = NULL;
 	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
-				     SCAN_DEFAULT_DEPTH, &site, &err);
+				     SCAN_DEFAULT_DEPTH, NULL, 0,
+				     &site, &err);
 	CHECK(r != NULL, "(gdfiled) file/d/ series page scans");
 	free(err);
 	if (!r) return;
@@ -1907,6 +1933,550 @@ test_ad_host_blocklist(void)
 	CHECK(!scan_is_ad_host(""), "empty host safe");
 }
 
+/* ---- default extension set now finds audio ----------------------------- */
+
+static void
+test_default_finds_audio(void)
+{
+	/* A page with an <a href> mp3 and a <source> flac. The default scan
+	 * (exts == NULL) must recognise both as audio file candidates. */
+	static const struct kv pages[] = {
+		{ "https://music.test/album/songs",
+		  "<html><body>"
+		  "<a href=\"https://cdn.music.test/track/song.mp3\">Song</a>"
+		  "<audio><source src=\"https://cdn.music.test/track/hifi.flac\"></audio>"
+		  "</body></html>" },
+	};
+	struct fake_site site = { pages, 1, NULL, 0 };
+
+	char *err = NULL;
+	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
+				     0, NULL, 0, &site, &err);
+	CHECK(r != NULL, "(audio) default audio page scans");
+	free(err);
+	if (!r) return;
+
+	int found_mp3 = 0, found_flac = 0;
+	for (size_t i = 0; i < r->ncands; i++) {
+		if (strcmp(r->cands[i].url,
+			   "https://cdn.music.test/track/song.mp3") == 0)
+			found_mp3 = 1;
+		if (strcmp(r->cands[i].url,
+			   "https://cdn.music.test/track/hifi.flac") == 0)
+			found_flac = 1;
+	}
+	CHECK(found_mp3, "(audio) mp3 href recognised by default set");
+	CHECK(found_flac, "(audio) flac <source> recognised by default set");
+	for (size_t i = 0; i < r->ncands; i++)
+		CHECK(r->cands[i].kind == SCAN_KIND_FILE,
+		      "(audio) audio candidates classified as file");
+	scan_result_free(r);
+}
+
+/* ---- --scan-ext custom: directory listing, any file type --------------- */
+
+static void
+test_scan_ext_directory_listing(void)
+{
+	/* Apache/nginx autoindex: relative <a href> to mixed-distro ISOs that
+	 * share NO numeric template (ubuntu-#.#.iso vs debian-#.iso).
+	 * URL has a :port and an index.html filename — the exact live failure
+	 * shape. The extension-list series path must fire and the generated
+	 * match must satisfy extractor_matches on a port-bearing landing URL. */
+	static const struct kv pages[] = {
+		{ "http://mirror.test:8080/isos/index.html",
+		  "<html><head><title>Index of /isos</title></head><body>"
+		  "<h1>Index of /isos</h1><pre>"
+		  "<a href=\"ubuntu-24.04.iso\">ubuntu-24.04.iso</a>\n"
+		  "<a href=\"ubuntu-22.04.iso\">ubuntu-22.04.iso</a>\n"
+		  "<a href=\"debian-12.iso\">debian-12.iso</a>\n"
+		  "<a href=\"readme.txt\">readme.txt</a>\n"
+		  "<a href=\"pic.png\">pic.png</a>\n"
+		  "</pre></body></html>" },
+	};
+	struct fake_site site = { pages, 1, NULL, 0 };
+
+	/* (1) exts = {"iso"}: three ISOs, no shared numeric template, :port URL.
+	 * Must produce a list config whose match fires on the port-bearing URL. */
+	const char *iso_only[] = { "iso" };
+	char *err = NULL;
+	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
+				     0, iso_only, 1, &site, &err);
+	CHECK(r != NULL, "(ext-iso) directory listing scans with iso filter");
+	free(err);
+	if (!r) return;
+
+	CHECK(r->ncands == 3, "(ext-iso) exactly 3 .iso candidates");
+	for (size_t i = 0; i < r->ncands; i++) {
+		CHECK(strstr(r->cands[i].url, ".iso") != NULL,
+		      "(ext-iso) every candidate is a .iso file");
+		CHECK(r->cands[i].kind == SCAN_KIND_FILE,
+		      "(ext-iso) iso candidate classified as file");
+	}
+	CHECK(r->is_series, "(ext-iso) >=3 iso files => extension-list series");
+	CHECK(r->list_ere != NULL, "(ext-iso) list_ere set");
+
+	char *cfg = NULL;
+	CHECK(emit_to_string(r, -1, &cfg) == 0 && cfg, "(ext-iso) config emits");
+	if (cfg) {
+		CHECK(strstr(cfg, "list   eps") != NULL, "(ext-iso) has list line");
+		CHECK(strstr(cfg, "output {url}") != NULL,
+		      "(ext-iso) has output {url}");
+
+		char *perr = NULL;
+		extractor_t *ex = extractor_parse(cfg, "(gen-ext-iso)", &perr);
+		CHECK(ex != NULL, "(ext-iso) generated config parses");
+		free(perr);
+		if (ex) {
+			/* Match must fire on the port-bearing landing URL (the live
+			 * failure: match was "127\.0\.0\.1/index\.html" without port
+			 * token, so :PORT broke the match). See #17. */
+			CHECK(extractor_matches(ex, pages[0].url) == 1,
+			      "(ext-iso) extractor matches port-bearing listing URL");
+			char **urls = NULL;
+			size_t n = 0;
+			char *lerr = NULL;
+			int lr = extractor_list_episodes(ex, pages[0].url,
+							 fake_fetch, &site,
+							 &urls, &n, &lerr);
+			CHECK(lr == 0, "(ext-iso) list_episodes succeeds");
+			if (lr != 0)
+				printf("  list err: %s\n", lerr ? lerr : "(none)");
+			free(lerr);
+			CHECK(n == 3, "(ext-iso) exactly 3 iso URLs listed");
+			int got24 = 0, got22 = 0, gotdeb = 0;
+			for (size_t i = 0; i < n; i++) {
+				if (!urls[i]) continue;
+				/* Resolved absolute against the listing URL. */
+				CHECK(strncmp(urls[i],
+					      "http://mirror.test:8080/isos/", 29) == 0,
+				      "(ext-iso) listed URL resolved absolute with port");
+				if (strstr(urls[i], "ubuntu-24.04.iso")) got24 = 1;
+				if (strstr(urls[i], "ubuntu-22.04.iso")) got22 = 1;
+				if (strstr(urls[i], "debian-12.iso"))    gotdeb = 1;
+			}
+			CHECK(got24 && got22 && gotdeb,
+			      "(ext-iso) all three iso files listed");
+			extractor_free_urls(urls, n);
+			extractor_free(ex);
+		}
+		free(cfg);
+	}
+	scan_result_free(r);
+
+	/* (2) exts = {"iso","txt"}: the iso files AND readme.txt (4 total). */
+	const char *iso_txt[] = { "iso", "txt" };
+	char *err2 = NULL;
+	scan_result_t *r2 = scan_page(pages[0].url, fake_fetch, fake_probe,
+				      0, iso_txt, 2, &site, &err2);
+	CHECK(r2 != NULL, "(ext-iso-txt) scans with iso,txt filter");
+	free(err2);
+	if (r2) {
+		CHECK(r2->ncands == 4, "(ext-iso-txt) 3 iso + 1 txt = 4 candidates");
+		int found_txt = 0, found_png = 0;
+		for (size_t i = 0; i < r2->ncands; i++) {
+			if (strstr(r2->cands[i].url, "readme.txt")) found_txt = 1;
+			if (strstr(r2->cands[i].url, "pic.png")) found_png = 1;
+		}
+		CHECK(found_txt, "(ext-iso-txt) readme.txt included");
+		CHECK(!found_png, "(ext-iso-txt) pic.png NOT included");
+		scan_result_free(r2);
+	}
+
+	/* (3) default media scan (exts == NULL): none of these are media. */
+	char *err3 = NULL;
+	scan_result_t *r3 = scan_page(pages[0].url, fake_fetch, fake_probe,
+				      0, NULL, 0, &site, &err3);
+	CHECK(r3 != NULL, "(ext-default) media-default scan of listing scans");
+	free(err3);
+	if (r3) {
+		CHECK(r3->ncands == 0,
+		      "(ext-default) no media candidates on a non-media listing");
+		scan_result_free(r3);
+	}
+}
+
+/* ---- parse_scan_ext validation tests ---------------------------------- */
+
+/* Local copy of parse_scan_ext so we can unit-test it without linking text.c.
+ * Must stay in sync with the production copy in text.c. See #17. */
+#define TEST_SCAN_EXT_MAX 64
+static int
+test_parse_scan_ext(const char *spec, char ***out, size_t *nout)
+{
+	*out = NULL;
+	*nout = 0;
+	if (!spec || !*spec)
+		return -1;
+
+	if (spec[strlen(spec) - 1] == ',')
+		return -1;
+
+	char **exts = calloc(TEST_SCAN_EXT_MAX, sizeof(*exts));
+	if (!exts)
+		return -1;
+	size_t n = 0;
+
+	const char *p = spec;
+	while (*p) {
+		const char *comma = strchr(p, ',');
+		const char *end = comma ? comma : p + strlen(p);
+
+		const char *ts = p;
+		while (ts < end && isspace((unsigned char)*ts))
+			ts++;
+		const char *te = end;
+		while (te > ts && isspace((unsigned char)te[-1]))
+			te--;
+		if (ts < te && *ts == '.')
+			ts++;
+
+		size_t len = (size_t)(te - ts);
+		if (len == 0)
+			goto bad;
+		if (n >= TEST_SCAN_EXT_MAX)
+			goto bad;
+
+		for (size_t i = 0; i < len; i++)
+			if (!isalnum((unsigned char)ts[i]))
+				goto bad;
+
+		char *tok = malloc(len + 1);
+		if (!tok)
+			goto bad;
+		for (size_t i = 0; i < len; i++)
+			tok[i] = (char)tolower((unsigned char)ts[i]);
+		tok[len] = '\0';
+
+		int dup = 0;
+		for (size_t i = 0; i < n; i++)
+			if (strcmp(exts[i], tok) == 0) { dup = 1; break; }
+		if (dup)
+			free(tok);
+		else
+			exts[n++] = tok;
+
+		if (!comma)
+			break;
+		p = comma + 1;
+	}
+
+	if (n == 0)
+		goto bad;
+
+	*out = exts;
+	*nout = n;
+	return 0;
+
+ bad:
+	for (size_t i = 0; i < n; i++)
+		free(exts[i]);
+	free(exts);
+	return -1;
+}
+
+static void
+test_parse_scan_ext_validation(void)
+{
+	/* Valid inputs. */
+	char **exts = NULL;
+	size_t n = 0;
+	CHECK(test_parse_scan_ext("iso", &exts, &n) == 0,
+	      "(pse) single token accepted");
+	CHECK(n == 1 && exts && strcmp(exts[0], "iso") == 0,
+	      "(pse) single token value");
+	{ for (size_t i = 0; i < n; i++) free(exts[i]); free(exts); exts = NULL; n = 0; }
+
+	CHECK(test_parse_scan_ext("iso,mp4,7z", &exts, &n) == 0,
+	      "(pse) iso,mp4,7z accepted");
+	CHECK(n == 3, "(pse) iso,mp4,7z -> 3 tokens");
+	{ for (size_t i = 0; i < n; i++) free(exts[i]); free(exts); exts = NULL; n = 0; }
+
+	/* Leading dot stripped. */
+	CHECK(test_parse_scan_ext(".iso", &exts, &n) == 0,
+	      "(pse) .iso leading dot stripped");
+	CHECK(n == 1 && exts && strcmp(exts[0], "iso") == 0,
+	      "(pse) .iso -> iso");
+	{ for (size_t i = 0; i < n; i++) free(exts[i]); free(exts); exts = NULL; n = 0; }
+
+	/* Dedup. */
+	CHECK(test_parse_scan_ext("iso,iso", &exts, &n) == 0,
+	      "(pse) dedup accepted");
+	CHECK(n == 1, "(pse) dedup -> 1 token");
+	{ for (size_t i = 0; i < n; i++) free(exts[i]); free(exts); exts = NULL; n = 0; }
+
+	/* FIX 3: ERE metacharacter in token rejected. */
+	CHECK(test_parse_scan_ext("iso,a{2}b", &exts, &n) != 0,
+	      "(pse) token with {} rejected (FIX3)");
+	CHECK(exts == NULL && n == 0, "(pse) {} rejection leaves output NULL");
+
+	CHECK(test_parse_scan_ext("mp4+webm", &exts, &n) != 0,
+	      "(pse) token with + rejected");
+
+	CHECK(test_parse_scan_ext("a.b", &exts, &n) != 0,
+	      "(pse) token with internal dot rejected");
+
+	/* FIX 4: trailing comma rejected. */
+	CHECK(test_parse_scan_ext("iso,", &exts, &n) != 0,
+	      "(pse) trailing comma rejected (FIX4)");
+	CHECK(exts == NULL && n == 0, "(pse) trailing-comma rejection leaves output NULL");
+
+	/* Leading comma rejected (was already). */
+	CHECK(test_parse_scan_ext(",iso", &exts, &n) != 0,
+	      "(pse) leading comma rejected");
+
+	/* Double comma rejected. */
+	CHECK(test_parse_scan_ext("iso,,zip", &exts, &n) != 0,
+	      "(pse) double comma rejected");
+
+	/* Empty string rejected. */
+	CHECK(test_parse_scan_ext("", &exts, &n) != 0,
+	      "(pse) empty string rejected");
+}
+
+/* ---- control character injection -> candidate rejected (FIX 2) --------- */
+
+static void
+test_cntrl_char_candidate_rejected(void)
+{
+	/* A page body containing a candidate with an embedded newline in the
+	 * href.  The newline would inject directives into the emitted config.
+	 * add_candidate must reject it silently. See #17. */
+	static const struct kv pages[] = {
+		{ "https://inject.test/page",
+		  "<html><body>"
+		  /* normal candidate */
+		  "<a href=\"safe.mp4\">safe</a>"
+		  /* crafted href with embedded newline: must be rejected */
+		  "<a href=\"bad\noutput /tmp/x\n.mp4\">evil</a>"
+		  "</body></html>" },
+	};
+	struct fake_site site = { pages, 1, NULL, 0 };
+
+	char *err = NULL;
+	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
+				     0, NULL, 0, &site, &err);
+	CHECK(r != NULL, "(cntrl) page scans without error");
+	free(err);
+	if (!r) return;
+
+	/* The crafted href must NOT appear as a candidate. */
+	int found_evil = 0;
+	for (size_t i = 0; i < r->ncands; i++)
+		if (strstr(r->cands[i].url, "output") ||
+		    strstr(r->cands[i].url, "/tmp"))
+			found_evil = 1;
+	CHECK(!found_evil, "(cntrl) candidate with embedded newline rejected");
+	scan_result_free(r);
+}
+
+/* ---- partial selection on relative-href directory listing (FIX 1) ------ */
+
+static void
+test_partial_selection_relative_hrefs(void)
+{
+	/* Directory listing with RELATIVE hrefs and a :port URL — the case that
+	 * broke: the old absolute-URL alternation matched nothing in the body.
+	 * Selecting 2 of 3 isos must roundtrip via extractor_list_episodes to
+	 * EXACTLY those 2, resolved absolute. See #17. */
+	static const struct kv pages[] = {
+		{ "http://mirror.test:9000/dl/index.html",
+		  "<html><body>"
+		  "<a href=\"arch-2024.iso\">arch</a>"
+		  "<a href=\"fedora-40.iso\">fedora</a>"
+		  "<a href=\"opensuse-15.iso\">opensuse</a>"
+		  "<a href=\"readme.txt\">readme</a>"
+		  "</body></html>" },
+	};
+	struct fake_site site = { pages, 1, NULL, 0 };
+
+	const char *iso_only[] = { "iso" };
+	char *err = NULL;
+	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
+				     0, iso_only, 1, &site, &err);
+	CHECK(r != NULL, "(psel) partial-sel page scans");
+	free(err);
+	if (!r) return;
+
+	CHECK(r->ncands == 3, "(psel) 3 iso candidates");
+	if (r->ncands != 3) { scan_result_free(r); return; }
+
+	/* Verify raw_ref is stored (the relative filename, not the absolute URL). */
+	int raw_ok = 1;
+	for (size_t i = 0; i < r->ncands; i++) {
+		if (!r->cands[i].raw_ref ||
+		    strstr(r->cands[i].raw_ref, "://"))
+			raw_ok = 0;	/* raw_ref should be relative, not absolute */
+	}
+	CHECK(raw_ok, "(psel) raw_ref is a relative ref, not an absolute URL");
+
+	/* Select indices 0 and 2, skip index 1. */
+	char url0[256], url2[256];
+	snprintf(url0, sizeof(url0), "%s", r->cands[0].url);
+	snprintf(url2, sizeof(url2), "%s", r->cands[2].url);
+	const char *raw1 = r->cands[1].raw_ref; /* the one we skip */
+
+	size_t sel[2] = { 0, 2 };
+	char *cfg = NULL;
+	size_t cfglen = 0;
+	FILE *fp = open_memstream(&cfg, &cfglen);
+	CHECK(fp != NULL, "(psel) memstream opens");
+	if (!fp) { scan_result_free(r); return; }
+
+	int rc = scan_emit_config_selection(r, sel, 2, fp);
+	fclose(fp);
+	CHECK(rc == 0 && cfg, "(psel) partial selection config emits");
+	if (rc != 0 || !cfg) { free(cfg); scan_result_free(r); return; }
+
+	CHECK(strstr(cfg, "list   eps") != NULL,
+	      "(psel) emits a list directive");
+	CHECK(strstr(cfg, "output {url}") != NULL,
+	      "(psel) emits output {url}");
+	/* The raw ref of the skipped candidate must NOT appear in the config. */
+	CHECK(!raw1 || strstr(cfg, raw1) == NULL,
+	      "(psel) skipped raw ref absent from config");
+
+	char *perr = NULL;
+	extractor_t *ex = extractor_parse(cfg, "(gen-psel)", &perr);
+	CHECK(ex != NULL, "(psel) partial-sel config parses");
+	free(perr);
+	if (ex) {
+		/* Match must fire on the port-bearing landing URL. */
+		CHECK(extractor_matches(ex, pages[0].url) == 1,
+		      "(psel) extractor matches port-bearing listing URL");
+
+		char **urls = NULL;
+		size_t n = 0;
+		char *lerr = NULL;
+		int lr = extractor_list_episodes(ex, pages[0].url,
+						 fake_fetch, &site,
+						 &urls, &n, &lerr);
+		CHECK(lr == 0, "(psel) list_episodes succeeds");
+		if (lr != 0)
+			printf("  psel list err: %s\n", lerr ? lerr : "(none)");
+		free(lerr);
+		CHECK(n == 2, "(psel) exactly 2 iso URLs listed");
+		int got0 = 0, got2 = 0, got1 = 0;
+		for (size_t i = 0; i < n; i++) {
+			if (!urls[i]) continue;
+			/* Each listed URL must be absolute. */
+			CHECK(strncmp(urls[i], "http://mirror.test:9000/dl/", 27) == 0,
+			      "(psel) listed URL resolved absolute with port");
+			if (strcmp(urls[i], url0) == 0) got0 = 1;
+			if (strcmp(urls[i], url2) == 0) got2 = 1;
+			if (strcmp(urls[i], r->cands[1].url) == 0) got1 = 1;
+		}
+		CHECK(got0 && got2, "(psel) both selected URLs present");
+		CHECK(!got1, "(psel) unselected URL absent");
+		extractor_free_urls(urls, n);
+		extractor_free(ex);
+	}
+	free(cfg);
+	scan_result_free(r);
+}
+
+/* ---- explicit selection -> alternation list config --------------------- */
+
+static void
+test_selection_alternation(void)
+{
+	/* A page whose body carries 3 absolute .bin URLs. We select 2 of the 3
+	 * and emit a `list` config that must roundtrip to EXACTLY those two. */
+	static const struct kv pages[] = {
+		{ "https://files.test/drop/page",
+		  "<html><body>"
+		  " https://cdn.files.test/a/one.bin "
+		  " https://cdn.files.test/a/two.bin "
+		  " https://cdn.files.test/a/three.bin "
+		  "</body></html>" },
+	};
+	struct fake_site site = { pages, 1, NULL, 0 };
+
+	const char *bin_only[] = { "bin" };
+	char *err = NULL;
+	scan_result_t *r = scan_page(pages[0].url, fake_fetch, fake_probe,
+				     0, bin_only, 1, &site, &err);
+	CHECK(r != NULL, "(sel) bin page scans");
+	free(err);
+	if (!r) return;
+	CHECK(r->ncands == 3, "(sel) 3 bin candidates found");
+	if (r->ncands != 3) { scan_result_free(r); return; }
+
+	/* Capture the two we will select (indices 0 and 2, skip the middle). */
+	char wa[256], wc[256];
+	snprintf(wa, sizeof(wa), "%s", r->cands[0].url);
+	snprintf(wc, sizeof(wc), "%s", r->cands[2].url);
+
+	size_t sel[2] = { 0, 2 };
+	char *cfg = NULL;
+	size_t len = 0;
+	FILE *fp = open_memstream(&cfg, &len);
+	CHECK(fp != NULL, "(sel) memstream opens");
+	if (fp) {
+		int rc = scan_emit_config_selection(r, sel, 2, fp);
+		fclose(fp);
+		CHECK(rc == 0 && cfg, "(sel) selection config emits");
+		if (rc == 0 && cfg) {
+			CHECK(strstr(cfg, "list   eps") != NULL,
+			      "(sel) emits a list directive");
+			CHECK(strstr(cfg, "output {url}") != NULL,
+			      "(sel) emits output {url}");
+
+			char *perr = NULL;
+			extractor_t *ex = extractor_parse(cfg, "(gen-sel)", &perr);
+			CHECK(ex != NULL, "(sel) selection config parses");
+			free(perr);
+			if (ex) {
+				char **urls = NULL;
+				size_t n = 0;
+				char *lerr = NULL;
+				int lr = extractor_list_episodes(ex, pages[0].url,
+								 fake_fetch, &site,
+								 &urls, &n, &lerr);
+				CHECK(lr == 0, "(sel) list_episodes succeeds");
+				if (lr != 0)
+					printf("  list err: %s\n",
+					       lerr ? lerr : "(none)");
+				free(lerr);
+				CHECK(n == 2, "(sel) exactly 2 selected URLs listed");
+				int got_a = 0, got_c = 0, got_b = 0;
+				for (size_t i = 0; i < n; i++) {
+					if (!urls[i]) continue;
+					if (strcmp(urls[i], wa) == 0) got_a = 1;
+					if (strcmp(urls[i], wc) == 0) got_c = 1;
+					if (strstr(urls[i], "two.bin")) got_b = 1;
+				}
+				CHECK(got_a && got_c,
+				      "(sel) both selected URLs present");
+				CHECK(!got_b,
+				      "(sel) the unselected URL is absent");
+				extractor_free_urls(urls, n);
+				extractor_free(ex);
+			}
+		}
+		free(cfg);
+	}
+
+	/* A single selected file keeps the static single-output form. */
+	size_t one[1] = { 1 };
+	char *cfg2 = NULL;
+	size_t len2 = 0;
+	FILE *fp2 = open_memstream(&cfg2, &len2);
+	if (fp2) {
+		int rc = scan_emit_config_selection(r, one, 1, fp2);
+		fclose(fp2);
+		CHECK(rc == 0 && cfg2, "(sel) single-selection config emits");
+		if (rc == 0 && cfg2) {
+			CHECK(strstr(cfg2, "output https://cdn.files.test/a/two.bin")
+			      != NULL, "(sel) single selection is a static output");
+			CHECK(strstr(cfg2, "list   eps") == NULL,
+			      "(sel) single selection is not a list");
+		}
+		free(cfg2);
+	}
+	scan_result_free(r);
+}
+
 int
 main(void)
 {
@@ -1935,6 +2505,12 @@ main(void)
 	test_skeleton_shape();
 	test_gdrive_normalize();
 	test_ad_host_blocklist();
+	test_default_finds_audio();
+	test_scan_ext_directory_listing();
+	test_selection_alternation();
+	test_parse_scan_ext_validation();
+	test_cntrl_char_candidate_rejected();
+	test_partial_selection_relative_hrefs();
 
 	if (failures == 0)
 		printf("OK: all %d checks passed\n", checks);
diff --git a/src/text.c b/src/text.c
index d3f7f4d..a32513f 100644
--- a/src/text.c
+++ b/src/text.c
@@ -99,6 +99,7 @@ int run = 1;
 #define EPISODES_OPT	264
 #define EXTRACT_SCAN_DEPTH_OPT	265
 #define SAVE_CONFIG_OPT	266
+#define SCAN_EXT_OPT	267
 
 #ifdef NOGETOPTLONG
 #define getopt_long(a, b, c, d, e) getopt(a, b, c)
@@ -134,6 +135,7 @@ static struct option flux_options[] = {
 	{"episodes",        1,      NULL, EPISODES_OPT},
 	{"extract-scan-depth", 1,   NULL, EXTRACT_SCAN_DEPTH_OPT},
 	{"save-config",     1,      NULL, SAVE_CONFIG_OPT},
+	{"scan-ext",        1,      NULL, SCAN_EXT_OPT},
 	{NULL,              0,      NULL, 0}
 };
 #endif
@@ -257,6 +259,100 @@ scan_pending_dir(char *dst, size_t len)
 	return 1;
 }
 
+/* Parse a comma-separated --scan-ext list into a malloc'd array of malloc'd
+ * lowercased tokens. Strips spaces and a leading '.', lowercases, dedups,
+ * rejects empty tokens, and caps at SCAN_EXT_MAX entries. On success stores the
+ * array in *out (caller frees each entry and the array) and the count in *nout,
+ * returns 0. On a malformed/empty list returns -1 with *out NULL / *nout 0. */
+#define SCAN_EXT_MAX	64
+static int
+parse_scan_ext(const char *spec, char ***out, size_t *nout)
+{
+	*out = NULL;
+	*nout = 0;
+	if (!spec || !*spec)
+		return -1;
+
+	/* A trailing comma means an empty final token. Catch it before any
+	 * allocations so the goto-bad path doesn't skip initialisers. See #17. */
+	if (spec[strlen(spec) - 1] == ',')
+		return -1;
+
+	char **exts = calloc(SCAN_EXT_MAX, sizeof(*exts));
+	if (!exts)
+		return -1;
+	size_t n = 0;
+
+	const char *p = spec;
+	while (*p) {
+		/* One token = up to the next comma. */
+		const char *comma = strchr(p, ',');
+		const char *end = comma ? comma : p + strlen(p);
+
+		/* Trim surrounding whitespace. */
+		const char *ts = p;
+		while (ts < end && isspace((unsigned char)*ts))
+			ts++;
+		const char *te = end;
+		while (te > ts && isspace((unsigned char)te[-1]))
+			te--;
+		/* Strip a single leading '.' (".iso" -> "iso"). */
+		if (ts < te && *ts == '.')
+			ts++;
+
+		size_t len = (size_t)(te - ts);
+		/* Empty token: covers leading comma, internal ",,", AND trailing
+		 * comma (comma != NULL but no chars after trimming). Reject all. */
+		if (len == 0)
+			goto bad;
+		if (n >= SCAN_EXT_MAX)
+			goto bad;	/* too many entries */
+
+		/* Real extensions are purely alphanumeric (iso, mkv, flac, 7z,
+		 * mp4, ...).  Reject anything else so ERE metacharacters can never
+		 * reach build_ext_alternation or the series ext_ere builder. */
+		for (size_t i = 0; i < len; i++)
+			if (!isalnum((unsigned char)ts[i]))
+				goto bad;
+
+		char *tok = malloc(len + 1);
+		if (!tok)
+			goto bad;
+		for (size_t i = 0; i < len; i++)
+			tok[i] = (char)tolower((unsigned char)ts[i]);
+		tok[len] = '\0';
+
+		/* Dedup (case-insensitive already, since lowercased). */
+		int dup = 0;
+		for (size_t i = 0; i < n; i++)
+			if (strcmp(exts[i], tok) == 0) {
+				dup = 1;
+				break;
+			}
+		if (dup)
+			free(tok);
+		else
+			exts[n++] = tok;
+
+		if (!comma)
+			break;
+		p = comma + 1;
+	}
+
+	if (n == 0)
+		goto bad;
+
+	*out = exts;
+	*nout = n;
+	return 0;
+
+ bad:
+	for (size_t i = 0; i < n; i++)
+		free(exts[i]);
+	free(exts);
+	return -1;
+}
+
 /* Run --extract-scan: scan `page_url`, optionally disambiguate via the TUI, and
  * emit a generated config. Output destination:
  *   - no -o (out_file NULL/empty) or '-o -': PRINT the config to stdout, stash
@@ -268,11 +364,13 @@ scan_pending_dir(char *dst, size_t len)
  * success, 1 on any error (matching the caller's exit-code convention). */
 static int
 run_extract_scan(conf_t *conf, const char *page_url, const char *out_file,
-		 int max_depth, int auto_yes)
+		 int max_depth, int auto_yes,
+		 const char *const *exts, size_t nexts)
 {
 	char *err = NULL;
 	scan_result_t *r = scan_page(page_url, extract_http_fetch,
-				     extract_size_probe, max_depth, conf, &err);
+				     extract_size_probe, max_depth, exts, nexts,
+				     conf, &err);
 	if (!r) {
 		fprintf(stderr, _("flux: scan failed: %s\n"),
 			err ? err : "unknown error");
@@ -280,27 +378,36 @@ run_extract_scan(conf_t *conf, const char *page_url, const char *out_file,
 		return 1;
 	}
 
-	int chosen = -1;	/* -1 -> emit the top-ranked candidate */
+	/* Selected candidate indices (NULL = no filtering: emit the top pick). */
+	size_t *sel = NULL;
+	size_t nsel = 0;
 
-	/* Ambiguous (>1 candidate) and interactive without --yes: ask the user.
-	 * The TUI itself degrades to a numbered prompt on a non-TTY. With --yes
-	 * or a single candidate we keep the scorer's top pick. */
+	/* Ambiguous (>1 candidate) and interactive without --yes: multi-select
+	 * which files go into the config. The TUI degrades to a numbered prompt
+	 * on a non-TTY. With --yes or a single candidate we include everything,
+	 * preserving today's non-interactive behavior. */
 	if (!auto_yes && r->ncands > 1) {
 		tui_item_t *items = calloc(r->ncands, sizeof(*items));
 		char (*details)[256] = calloc(r->ncands, sizeof(*details));
-		if (!items || !details) {
+		unsigned char *preselect = malloc(r->ncands);
+		if (!items || !details || !preselect) {
 			free(items);
 			free(details);
+			free(preselect);
 			scan_result_free(r);
 			fprintf(stderr, _("flux: out of memory\n"));
 			return 1;
 		}
 		for (size_t i = 0; i < r->ncands; i++) {
 			const scan_candidate_t *c = &r->cands[i];
+			/* Label = basename of the URL (fall back to full URL). */
+			const char *slash = strrchr(c->url, '/');
+			const char *base = (slash && slash[1]) ? slash + 1 : c->url;
 			int o = 0;
 			o += snprintf(details[i] + o, sizeof(details[i]) - o,
 				      "%s score=%.0f",
-				      c->kind == SCAN_KIND_HLS ? "hls" : "file",
+				      c->kind == SCAN_KIND_HLS    ? "hls" :
+				      c->kind == SCAN_KIND_GDRIVE ? "gdrive" : "file",
 				      c->score);
 			if (c->duration > 0 && o >= 0 &&
 			    (size_t)o < sizeof(details[i]))
@@ -319,24 +426,35 @@ run_extract_scan(conf_t *conf, const char *page_url, const char *out_file,
 			if (c->ad_host && o >= 0 && (size_t)o < sizeof(details[i]))
 				snprintf(details[i] + o, sizeof(details[i]) - o,
 					 " [ad]");
-			items[i].label = c->url;
+			items[i].label = base;
 			items[i].detail = details[i];
+			preselect[i] = 1;	/* default: all selected */
 		}
-		chosen = tui_select_one(_("Select the media stream to extract:"),
-					items, r->ncands);
+		int got = tui_select_many(
+			_("Select the files to include in the config:"),
+			items, r->ncands, preselect, &sel);
 		free(items);
 		free(details);
-		if (chosen < 0) {	/* user cancelled */
+		free(preselect);
+		if (got == -1) {	/* user cancelled */
 			scan_result_free(r);
 			fprintf(stderr, _("flux: scan cancelled.\n"));
 			return 1;
 		}
+		if (got == -2) {	/* allocation failure in the TUI */
+			scan_result_free(r);
+			fprintf(stderr, _("flux: out of memory\n"));
+			return 1;
+		}
+		if (got == 0) {		/* nothing selected: nothing to emit */
+			free(sel);
+			scan_result_free(r);
+			fprintf(stderr, _("flux: no files selected.\n"));
+			return 1;
+		}
+		nsel = (size_t)got;
 	}
 
-	/* Non-TTY + ambiguous + no --yes: scan_page still ran, but we must not
-	 * silently guess. tui_select_one's fallback already handled the prompt
-	 * above; if it returned a valid index we proceed. */
-
 	/* '-o FILE' (not '-') writes the config to FILE explicitly; anything else
 	 * (no -o, or '-o -') prints to stdout and stashes a pending copy. */
 	int to_stdout = (out_file && strcmp(out_file, "-") == 0);
@@ -347,12 +465,15 @@ run_extract_scan(conf_t *conf, const char *page_url, const char *out_file,
 		if (!out) {
 			fprintf(stderr, _("flux: cannot write config to %s: %s\n"),
 				out_file, strerror(errno));
+			free(sel);
 			scan_result_free(r);
 			return 1;
 		}
-		int er = scan_emit_config(r, chosen, out);
+		int er = sel ? scan_emit_config_selection(r, sel, nsel, out)
+			     : scan_emit_config(r, -1, out);
 		if (fclose(out) != 0)
 			er = -1;
+		free(sel);
 		scan_result_free(r);
 		if (er != 0) {
 			fprintf(stderr,
@@ -372,11 +493,15 @@ run_extract_scan(conf_t *conf, const char *page_url, const char *out_file,
 	size_t clen = 0;
 	FILE *mp = open_memstream(&cfg, &clen);
 	if (!mp) {
+		free(sel);
 		scan_result_free(r);
 		fprintf(stderr, _("flux: out of memory\n"));
 		return 1;
 	}
-	int er = scan_emit_config(r, chosen, mp);
+	int er = sel ? scan_emit_config_selection(r, sel, nsel, mp)
+		     : scan_emit_config(r, -1, mp);
+	free(sel);
+	sel = NULL;
 	if (fclose(mp) != 0)
 		er = -1;
 	if (er != 0) {
@@ -607,6 +732,7 @@ main(int argc, char *argv[])
 	const char *episodes_spec = NULL;	/* --episodes 1,3-5,8 */
 	int scan_depth = SCAN_DEFAULT_DEPTH;	/* --extract-scan-depth (0..MAX) */
 	const char *save_config_id = NULL;	/* --save-config <id> */
+	const char *scan_ext_spec = NULL;	/* --scan-ext=iso,zip,... */
 
 	fn[0] = 0;
 
@@ -765,6 +891,9 @@ main(int argc, char *argv[])
 		case SAVE_CONFIG_OPT:
 			save_config_id = optarg;
 			break;
+		case SCAN_EXT_OPT:
+			scan_ext_spec = optarg;
+			break;
 		case QUALITY_OPT:
 			hls_quality = optarg;
 			break;
@@ -810,11 +939,31 @@ main(int argc, char *argv[])
 		goto free_conf;
 	}
 
+	/* --scan-ext only applies to --extract-scan; reject it otherwise. */
+	if (scan_ext_spec && !scan_url) {
+		fprintf(stderr,
+			_("flux: --scan-ext requires --extract-scan.\n"));
+		goto free_conf;
+	}
+
 	/* --extract-scan carries its own URL and writes a config (to -o or
 	 * stdout) instead of downloading; handle it before the positional-URL
 	 * dispatch and exit. */
 	if (scan_url) {
-		ret = run_extract_scan(conf, scan_url, fn, scan_depth, auto_yes);
+		char **scan_exts = NULL;
+		size_t nscan_exts = 0;
+		if (scan_ext_spec &&
+		    parse_scan_ext(scan_ext_spec, &scan_exts, &nscan_exts) != 0) {
+			fprintf(stderr,
+				_("flux: invalid --scan-ext list '%s'.\n"),
+				scan_ext_spec);
+			goto free_conf;
+		}
+		ret = run_extract_scan(conf, scan_url, fn, scan_depth, auto_yes,
+				       (const char *const *)scan_exts, nscan_exts);
+		for (size_t i = 0; i < nscan_exts; i++)
+			free(scan_exts[i]);
+		free(scan_exts);
 		goto free_conf;
 	}
 
@@ -2108,6 +2257,7 @@ print_help(void)
 		 "--extract-list\t\t\tList discovered extractor configs\n"
 		 "--extract-scan=url\t\tScan a page, print the config, and suggest --save-config (-o FILE writes to a path)\n"
 		 "--extract-scan-depth=N\t\tHops to follow for watch/play/embed pages (default 2, max 3)\n"
+		 "--scan-ext=list\t\t\t--extract-scan: find these extensions only, any type (default: video and audio)\n"
 		 "--save-config=id\t\tSave a previously scanned pending config (its id) active\n"
 		 "--yes\t\t\t\tNon-interactive: auto-pick the top candidate\n"
 		 "--all\t\t\t\tSeries: download every episode (no prompt)\n"