@tomflow/chatloop-extension 0.3.37 → 0.3.44

package/README.md

@@ -1,5 +1,15 @@
 # @tomflow/chatloop-extension
 
+## P0 资源生命周期（Extension Worker 唯一仲裁）
+
+`extension/loop/resources.js` 在既有 Worker 内维护持久资源索引，不引入第二浏览器驱动。正式 Action 同时最多 3 页，已登记执行 Chat 同时最多 2 页（Owner 与 Handoff successor）；新建前拒绝超限。已存在的普通 Chat、未知发送、BLOCKED 或带草稿页面不自动关闭。只对精确登记且测试 projectId 为 `cl-intent-e2e-*` 的 DONE Chat 执行空草稿、非激活、URL 未变化的 TTL 回收。用户真实任务的 Chat 不会自动删除；其配额满时安全拒绝新建，需用户确认归属后清理。机器只读 Action 最多 3 分钟后有界回收；写入 Action 仅凭匹配终态与 token 回收。资源创建/关闭/峰值/拒绝写入同一 `chat-loop.resources.v1`，Acceptance Audit 读取该记录；未知收据不补发。`ACTION_RESULT_TIMEOUT_UNVERIFIED` 为安全 BLOCKED，不是自动重试。
+
+**失败 Start 诊断（本地 0.3.44）**：首轮发送前若新 Chat 主页未就绪，Worker 保持 BLOCKED/START_SEND_UNVERIFIED；新增仅审计字段 `lastStartFailureCode` 记录安全白名单里的未就绪原因，`popup.html?audit=1` 的失败页探针只提供 DOM 就绪状态和控件存在布尔值，不读草稿/正文/密钥。它不证明页面可自动绕过挑战，也不能授权重发或清理未确认草稿。
+
+**手动入口限额**：Popup 的 Clean 点击也必须经 Worker 同一 Action 配额准入；开发验收 New Test 一次最多保留一个已登记测试/首页，不能从旁路无限创建标签。
+
+**验收边界**：源码测试不等于已安装 Chrome 实测。安装 npm 新包并 Reload 后须由正式 Extension Audit 验证 `resources` 字段及资源前后/峰值；未见该字段即表示仍在运行旧扩展。
+
 Chrome 扩展（9 个独立 Action，含 Status / Start）及其独立 CLI / Native Messaging Host。执行前先看 Help：
 
 ```sh

package/extension/acceptance.js

@@ -1,10 +1,11 @@
 // Read-only acceptance inventory and strictly scoped test-tab lifecycle.
 (() => {
   const q = new URLSearchParams(location.search);
-  const modes = ["audit", "newTest", "cleanup", "cleanupVerified", "cleanupStaleMachine", "cleanupTestHome"].filter(k => q.has(k));
+  const modes = ["audit", "newTest", "cleanup", "cleanupVerified", "cleanupStaleMachine", "cleanupTestHome", "cleanupFailedStartHome"].filter(k => q.has(k));
   if (!modes.length) return; // Ordinary popup remains unchanged.
   const runKey = "chat-loop.action.run.v1";
   const ownedKey = "chat-loop.acceptance.owned.v1";
+  const resourcesKey = "chat-loop.resources.v1";
   const extensionOrigin = chrome.runtime.getURL("").replace(/\/$/, "");
   const status = document.getElementById("status");
   const detail = document.getElementById("detail");
@@ -17,7 +18,7 @@
     if (!own?.id || !own.url?.startsWith(chrome.runtime.getURL("popup.html")))
       throw Error("INVALID_ACCEPTANCE_PAGE");
     const [state, allBeforeCleanup] = await Promise.all([
-      chrome.storage.local.get([runKey, ownedKey]), chrome.tabs.query({})
+      chrome.storage.local.get([runKey, ownedKey, resourcesKey]), chrome.tabs.query({})
     ]);
     // Only an old read-only acceptance audit page may be automatically reaped.
     // These are diagnostics, not Chat conversations or formal Action pages.
@@ -35,7 +36,21 @@
     const all = removedStaleAudits.length ? await chrome.tabs.query({}) : allBeforeCleanup;
     const run = state[runKey] || null;
     const owned = Array.isArray(state[ownedKey]) ? state[ownedKey] : [];
+    const resourceState = state[resourcesKey] || {};
+    const resourceActions = all.filter(t => t.url?.startsWith(extensionOrigin + "/")
+      && /\/(?:start|continue|handoff|status|text|dom|screenshot|reload|clean|clock)\.html(?:\?|$)/.test(t.url)).length;
+    const resourceChats = Array.isArray(resourceState.entries)
+      ? resourceState.entries.filter(e => e.kind === "chat"
+        && all.some(t => t.id === e.id)).length : 0;
     const audit = {at: new Date().toISOString(), mode,
+      resources: {policy:{actionLimit:3,ownedChatLimit:2},
+        created:resourceState.created || 0,observed:resourceState.observed || 0,
+        closed:resourceState.closed || 0,denied:resourceState.denied || 0,
+        peakActions:resourceState.peakActions || 0,
+        peakChats:resourceState.peakChats || 0,
+        liveActions:resourceActions,liveOwnedChats:resourceChats,
+        lastDenial:resourceState.lastDenial || null,
+        lastReaped:resourceState.lastReaped || null},
       removedStaleAuditTabs: removedStaleAudits,
       version: chrome.runtime.getManifest().version, totalTabs: all.length,
       otherTabCount: all.filter(t => !isChat(t.url) && !t.url?.startsWith(extensionOrigin)).length,
@@ -48,7 +63,7 @@
       ownedTestTabs: owned,
       messageEvidence: {}, actionEvidence: {},
       run: run ? Object.fromEntries(["phase", "action", "reason", "tabId", "page",
-        "sourceTabId", "sourcePage", "attemptedNewTabId", "newUserKey",
+        "sourceTabId", "sourcePage", "attemptedNewTabId", "lastStartFailureCode", "newUserKey",
         "sessionId", "projectId", "generation",
         "userKey", "assistantKey", "startedAt", "deadlineAt", "handoffPending",
         "handoffPendingAt", "handoffMode", "testSetup", "timedTest", "testTurnIndex",
@@ -62,6 +77,33 @@
     if (run?.parseEvidence && owned.some(item => item.id === run.tabId || item.id === run.sourceTabId)) {
       audit.run.parseEvidence = run.parseEvidence;
     }
+    // Read-only diagnosis of a failed pre-send test home, never a send or cleanup.
+    if (run?.phase === 'BLOCKED' && /^cl-intent-e2e-[a-z0-9-]+$/i.test(run.projectId || '')
+      && Number.isInteger(run.attemptedNewTabId)) {
+      const candidate=all.find(t=>t.id===run.attemptedNewTabId
+        && t.url==='https://chatgpt.com/');
+      if (candidate) {
+        try {
+          const [p]=await chrome.scripting.executeScript({target:{tabId:candidate.id},
+            func:()=>{
+              const visible=e=>!!e?.getClientRects?.().length;
+              const mains=[...document.querySelectorAll('main')].filter(visible);
+              const editor=document.querySelector('[contenteditable="true"][data-composer-markdown]')
+                ||document.querySelector('#prompt-textarea[contenteditable="true"]');
+              return {pathname:location.pathname,mainCount:mains.length,
+                readyState:document.readyState,
+                editorExists:!!editor,editorVisible:visible(editor),
+                editorBlank:editor?!(editor.innerText||editor.textContent||'').trim():null,
+                hasOtherEditable:!!document.querySelector('[contenteditable="true"]'),
+                hasTextarea:!!document.querySelector('textarea'),
+                hasTextbox:!!document.querySelector('[role="textbox"]'),
+                hasChallengeFrame:!!document.querySelector('iframe[src*="challenge"],iframe[src*="captcha"]'),
+                mainHasMessages:mains.some(m=>!!m.querySelector('[data-chatgpt-search-message-ids],[data-message-author-role]'))};
+            }});
+          audit.failedStartHome=p?.result||{status:'NO_PROBE_RESULT'};
+        } catch {audit.failedStartHome={status:'PROBE_UNAVAILABLE'};}
+      }
+    }
     // Inspect only this extension's own open action pages: a failed test setup
     // must expose a readable failure code, never trigger a second send.
     for (const tab of audit.extensionTabs) {
@@ -125,7 +167,15 @@
         audit.messageEvidence[id] = read?.result || {status: "EMPTY_RESULT"};
         // Only dedicated tests created by this diagnostic may expose their
         // harmless assistant text, for verifying strict status parsing.
-        if (owned.some(item => item.id === id || (item.id === run?.sourceTabId && id === run?.tabId))) {
+        const ownedAcceptance = owned.some(item => item.id === id
+          || (item.id === run?.sourceTabId && id === run?.tabId));
+        // The existing read-only Audit may also inspect the CURRENT, exactly
+        // matched Worker-owned Chat. It drives the Observer's existing poll,
+        // never types into a conversation or creates an Action. Never persist
+        // unapproved user reply text for ordinary project sessions.
+        const currentOwner = run?.tabId === id
+          && audit.messageEvidence[id]?.url === "https://chatgpt.com" + run.page;
+        if (ownedAcceptance || currentOwner) {
           const proof = await chrome.tabs.sendMessage(id,
             {type: "CHAT_LOOP_TURN_VERIFY_V1"}).catch(() => null);
           audit.messageEvidence[id].observerStatus = proof?.status || "UNAVAILABLE";
@@ -135,7 +185,7 @@
             status: observed.status, reason: observed.reason, page: observed.page,
             userKey: observed.userKey, eventCount: observed.eventCount,
             observedAt: observed.observedAt} : null;
-          audit.messageEvidence[id].observerReplyText =
+          if (ownedAcceptance) audit.messageEvidence[id].observerReplyText =
             typeof proof?.replyText === "string" ? proof.replyText.slice(0, 3000) : null;
         }
       } catch {
@@ -145,6 +195,11 @@
     if (mode === "newTest") {
       if (run && !["DONE", "BLOCKED"].includes(run.phase))
         throw Error("ACTIVE_LOOP_OWNERSHIP");
+      // A development-only acceptance entry must never create an unbounded
+      // stack of blank/test pages. Existing user homes also consume capacity.
+      if (all.some(tab => tab.url === 'https://chatgpt.com/'
+        || owned.some(item => item.id === tab.id)))
+        throw Error('ACCEPTANCE_TEST_HOME_LIMIT');
       const tab = await chrome.tabs.create({url: "https://chatgpt.com/", active: true,
         windowId: own.windowId});
       const next = [...owned, {id: tab.id, createdAt: Date.now()}];
@@ -262,6 +317,36 @@
         chatTabs: left.filter(tab => isChat(tab.url)).length,
         extensionTabs: left.filter(tab => tab.url?.startsWith(extensionOrigin)
           && tab.id !== own.id).length};
+    } else if (mode === "cleanupFailedStartHome") {
+      // Only a known failed pre-send Start home, never a Chat conversation.
+      const id=Number(q.get('cleanupFailedStartHome'));
+      if(!run || run.phase!=='BLOCKED' || run.action!=='START'
+        || run.reason!=='START_SEND_UNVERIFIED'
+        || !/^cl-intent-e2e-[a-z0-9-]+$/i.test(run.projectId||'')
+        || !Number.isSafeInteger(id) || id!==run.attemptedNewTabId)
+        throw Error('FAILED_START_OWNERSHIP_UNVERIFIED');
+      const tab=await chrome.tabs.get(id).catch(()=>null);
+      if(tab?.url!=='https://chatgpt.com/' || tab.active || tab.pinned)
+        throw Error('FAILED_START_HOME_NOT_SAFE');
+      const [p]=await chrome.scripting.executeScript({target:{tabId:id},func:()=>{
+        const visible=e=>!!e?.getClientRects?.().length;
+        const mains=[...document.querySelectorAll('main')].filter(visible);
+        const editor=document.querySelector('[contenteditable="true"][data-composer-markdown]')
+          ||document.querySelector('#prompt-textarea[contenteditable="true"]');
+        const noUploads=!document.querySelector('[data-testid*="attachment-preview"], [data-testid*="image-preview"], [data-testid="composer-attachment"]');
+        return location.href==='https://chatgpt.com/' && mains.length===1
+          && visible(editor) && !(editor.innerText||editor.textContent||'').trim()
+          && !mains[0].querySelector('[data-chatgpt-search-message-ids],[data-message-author-role]')
+          && noUploads;
+      }});
+      if(p?.result!==true)throw Error('FAILED_START_HOME_NOT_BLANK');
+      const latest=(await chrome.storage.local.get(runKey))[runKey];
+      const live=await chrome.tabs.get(id).catch(()=>null);
+      if(latest?.phase!=='BLOCKED' || latest.sessionId!==run.sessionId
+        || latest.attemptedNewTabId!==id || live?.url!==tab.url
+        || live.active || live.pinned)throw Error('FAILED_START_CHANGED');
+      await chrome.tabs.remove(id);
+      audit.cleanedFailedStartHome=id;
     } else if (mode === "cleanupTestHome") {
       // Close only an unstarted HOME tab created by this acceptance utility.
       // Never discard a personal draft, real conversation or unknown upload.

package/extension/actions/handoff.js

@@ -247,6 +247,13 @@ async function run() {
     || (permit.handoffMode === "EXPLICIT" && typeof permit.text !== "string")
     || !["TIMED", "EXPLICIT", "ERROR"].includes(permit.handoffMode))
     throw Error("HANDOFF_NOT_AUTHORIZED");
+  const quota=await chrome.runtime.sendMessage({type:'CHAT_LOOP_RESOURCE_CHAT_V1',
+    action:'handoff',stage:'preflight'});
+  if(quota?.status!=='OK') {
+    await chrome.runtime.sendMessage({type:'CHAT_LOOP_ACTION_RESULT_V1',...request,
+      result:'UNVERIFIED',reason:quota?.code||'RESOURCE_QUOTA_UNVERIFIED'}).catch(()=>{});
+    throw Error(quota?.code||'RESOURCE_QUOTA_UNVERIFIED');
+  }
   show("RUNNING", "已领取不可重试的一次性授权，验证旧会话交接信息。");
   let result;
   let newTab;
@@ -256,11 +263,22 @@ async function run() {
     if (permit.target.page.startsWith('/g/')) throw Error('PROJECT_HANDOFF_ROUTE_UNVERIFIED');
     // Opening a new Chat is itself a side effect; never create another on failure.
     newTab = await chrome.tabs.create({url: "https://chatgpt.com/", active: true,
-      windowId: source.windowId});
+      windowId: source.windowId, openerTabId: own.id});
     const registry = (await chrome.storage.local.get("chat-loop.acceptance.owned.v1"))[
       "chat-loop.acceptance.owned.v1"];
     const dedicatedTest = Array.isArray(registry)
       && registry.some(item => item.id === request.tabId);
+    // Chrome may initially report about:blank while the requested home URL loads.
+    let homeUrlReady=false;
+    for(let i=0;i<40;i++){
+      const candidate=await chrome.tabs.get(newTab.id).catch(()=>null);
+      if(candidate?.url==='https://chatgpt.com/'){homeUrlReady=true;break;}
+      await new Promise(resolve=>setTimeout(resolve,250));
+    }
+    if(!homeUrlReady)throw Error('HANDOFF_HOME_URL_UNVERIFIED');
+    const registered=await chrome.runtime.sendMessage({type:'CHAT_LOOP_RESOURCE_CHAT_V1',
+      action:'handoff',stage:'register',tabId:newTab.id});
+    if(registered?.status!=='OK')throw Error(registered?.code||'RESOURCE_REGISTER_UNVERIFIED');
     await waitForNewChat(newTab.id, dedicatedTest);
     // The observer must exist before the first user click on the new home page.
     // A successful send without an observer cannot be automatically continued.

package/extension/actions/start.js

@@ -4,6 +4,14 @@ const info=document.getElementById('details'),label=document.getElementById('sta
 const pause=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 const show=(s,d)=>{label.textContent=s;info.textContent=d;document.body.dataset.result=s==='SUCCESS'?'success':'error';};
 const host='com.tomflow.chatloop.extension';
+async function waitForHomeUrl(id){
+  for(let i=0;i<40;i++){
+    const tab=await chrome.tabs.get(id).catch(()=>null);
+    if(tab?.url==='https://chatgpt.com/')return;
+    await pause(250);
+  }
+  throw Error('START_HOME_URL_UNVERIFIED');
+}
 async function newChatReady(id){
   for(let i=0;i<85;i++){
     const tab=await chrome.tabs.get(id).catch(()=>null);
@@ -18,7 +26,8 @@ async function newChatReady(id){
           &&!mains[0].querySelector('[data-chatgpt-search-message-ids],[data-message-author-role]');
       }}).catch(()=>[]);
       if(found?.result===true)return;
-      if(found?.result===false&&i>=15)throw Error('NEW_CHAT_NOT_BLANK_OR_READY');
+      // A newly opened ChatGPT home may hydrate slowly; never fail at 6 seconds.
+      // Exhaust the bounded 35-second readiness window without sending.
     }
     await pause(420);
   }
@@ -120,8 +129,16 @@ async function run(){
       requestId:id,token:prepared.token});
     if(taken?.status!=='OK'||taken.sessionId!==prepared.sessionId
       ||typeof taken.prompt!=='string')throw Error(taken?.code||'START_TAKE_DENIED');
+    const quota=await chrome.runtime.sendMessage({type:'CHAT_LOOP_RESOURCE_CHAT_V1',
+      action:'start',stage:'preflight'});
+    if(quota?.status!=='OK')throw Error(quota?.code||'RESOURCE_QUOTA_UNVERIFIED');
     show('RUNNING','已独占会话，正在创建唯一网页 Chat 并确认首轮发送。');
-    newTab=await chrome.tabs.create({url:'https://chatgpt.com/',active:true,windowId:own.windowId});
+    newTab=await chrome.tabs.create({url:'https://chatgpt.com/',active:true,
+      windowId:own.windowId,openerTabId:own.id});
+    await waitForHomeUrl(newTab.id);
+    const registered=await chrome.runtime.sendMessage({type:'CHAT_LOOP_RESOURCE_CHAT_V1',
+      action:'start',stage:'register',tabId:newTab.id});
+    if(registered?.status!=='OK')throw Error(registered?.code||'RESOURCE_REGISTER_UNVERIFIED');
     await newChatReady(newTab.id);
     await observerReady(newTab.id);
     const receipt=await sendFirst(newTab.id,taken.prompt);
@@ -134,12 +151,22 @@ async function run(){
     show('SUCCESS','唯一网页 Chat 已确认；执行由 Observer 和 Continue/Handoff 接管。');
     await chrome.tabs.remove(own.id);
   }catch(e){
-    if(taken&&committed?.status!=='OK')
+    if(taken&&committed?.status!=='OK') {
+      // This is diagnostics only; it does NOT authorize a retry or prove a
+      // message was never sent. Keep the existing fail-closed Owner semantics.
+      const failureCode=['START_HOME_URL_UNVERIFIED','NEW_CHAT_NOT_READY',
+        'FIRST_TURN_OBSERVER_UNAVAILABLE'].includes(e.message) ? e.message : null;
       await chrome.runtime.sendMessage({type:'CHAT_LOOP_SESSION_START_RESULT_V1',
-        requestId:id,token:prepared.token,result:'UNVERIFIED',newTabId:newTab?.id}).catch(()=>{});
-    await chrome.runtime.sendNativeMessage(host,{op:'complete',id,nonce:proof.nonce,
-      action:'start',status:'FAILED',code:String(e.message||'START_UNVERIFIED').slice(0,100)}).catch(()=>{});
-    throw e; // Unknown target tab is kept for inspection, never auto-retried.
+        requestId:id,token:prepared.token,result:'UNVERIFIED',newTabId:newTab?.id,
+        ...(failureCode?{failureCode}:{})}).catch(()=>{});
+    }
+    const failed=await chrome.runtime.sendNativeMessage(host,{op:'complete',id,nonce:proof.nonce,
+      action:'start',status:'FAILED',code:String(e.message||'START_UNVERIFIED').slice(0,100)}).catch(()=>null);
+    // Only the Action page closes after its durable FAILED receipt; the
+    // possibly-sent Chat and any unverified draft remain untouched.
+    if(failed?.status==='SAVED' && failed.id===id)
+      await chrome.tabs.remove(own.id).catch(()=>{});
+    throw e; // Never auto-retry a possibly clicked first user Turn.
   }
 }
 void run().catch(e=>show('BLOCKED',e.message||'START_UNVERIFIED'));

package/extension/background.js

@@ -1,6 +1,6 @@
 // Chat Loop browser scheduler. It never types or clicks in ChatGPT.
 // Only extension-owned Action pages execute Continue or cross-Chat Handoff.
-importScripts("loop/core.js");
+importScripts("loop/core.js", "loop/resources.js");
 const RUN_KEY = "chat-loop.action.run.v1";
 const SESSION_HOST = "com.tomflow.chatloop.extension";
 const HOUR_MS = 60 * 60 * 1000; // Acceptance wall-clock hours are independent of the MVP timeout.
@@ -40,6 +40,15 @@ const serial = fn => {
   queue = work.catch(() => {});
   return work;
 };
+// Admission and recovery run in this same Worker, never another browser executor.
+const resources = globalThis.ChatLoopResourcesV1;
+async function createBoundedAction(options) {
+  const quota=await resources.admit(await readRun(),{kind:'action'});
+  if (!quota.ok) throw Error(quota.code);
+  const tab=await chrome.tabs.create(options);
+  if (!await resources.registerAction(tab)) throw Error('ACTION_RESOURCE_UNVERIFIED');
+  return tab;
+}
 const pathOf = url => {
   try {
     const u = new URL(url);
@@ -91,7 +100,12 @@ async function saveRun(run) {
   const now = Date.now(), deadlineAt = deadlineOf(run);
   // Persist the intent even when a delayed alarm arrives after an Action
   // receipt. This never revokes a Continue already reserved before deadline.
-  const next = {...run, ...(deadlineAt ? {deadlineAt} : {})};
+  const sending = ["STARTING","RESERVED","PENDING"].includes(run.phase);
+  const marker = sending && typeof run.token==="string" ? run.token : null;
+  const next = {...run, ...(deadlineAt ? {deadlineAt} : {}),
+    ...(marker ? {actionPendingAt: run.resourceToken===marker
+      && Number.isSafeInteger(run.actionPendingAt) ? run.actionPendingAt : now,
+      resourceToken:marker} : {})};
   if (clockActive(next) && deadlineAt !== null && now >= deadlineAt
     && !next.handoffPending) {
     next.handoffPending = true;
@@ -106,6 +120,9 @@ async function saveRun(run) {
     if(saved?.status!=="OK"||saved.session?.sessionId!==next.sessionId)
       throw Error(saved?.code||"SESSION_PERSISTENCE_UNVERIFIED");
   }
+  // The resource inventory is derived evidence; it never grants browser Owner.
+  if (["DONE","BLOCKED"].includes(next.phase))
+    await resources.terminal(next).catch(()=>{});
 
   try {
     if (clockActive(next) && !next.handoffPending && deadlineAt > Date.now()) {
@@ -132,6 +149,33 @@ function sessionProjection(run) {
 const sessionPage=(sender,name,id)=> Number.isInteger(sender.tab?.id)
   && typeof id==='string'&&/^[a-f0-9]{32}$/.test(id)
   && sender.url===chrome.runtime.getURL(name+'.html')+'?requestId='+id;
+async function resourceChatGate(message,sender) {
+  const run=await readRun();
+  if(run?.phase!=='PENDING'
+    || !['start','handoff'].includes(message.action))
+    return {status:'DENIED',code:'RESOURCE_OWNER_NOT_PENDING'};
+  const authorized=message.action==='start'
+    ? run.action==='START' && run.machineActionTabId===sender.tab?.id
+      && sessionPage(sender,'start',run.machineRequestId)
+    : run.action==='HANDOFF' && isAction(sender,
+      {tabId:run.tabId,token:run.token},run);
+  if(!authorized)return {status:'DENIED',code:'RESOURCE_ACTION_SOURCE_INVALID'};
+  if(message.stage==='preflight') {
+    const quota=await resources.admit(run,{kind:'chat'});
+    return quota.ok?{status:'OK',code:'RESOURCE_CHAT_PERMITTED'}
+      :{status:'DENIED',code:quota.code};
+  }
+  if(message.stage!=='register' || !Number.isInteger(message.tabId))
+    return {status:'DENIED',code:'RESOURCE_REGISTER_INVALID'};
+  const tab=await chrome.tabs.get(message.tabId).catch(()=>null);
+  if (!tab || tab.id===run.tabId || tab.id===sender.tab.id
+    || !await resources.registerChat(tab,run))
+    return {status:'DENIED',code:'RESOURCE_CHAT_NOT_VERIFIED'};
+  const inventory=await resources.reconcile(run);
+  if(inventory.chatCount>resources.CHAT_LIMIT)
+    return {status:'DENIED',code:'RESOURCE_CHAT_LIMIT'};
+  return {status:'OK',code:'RESOURCE_CHAT_REGISTERED'};
+}
 async function sessionStartPrepare(message,sender){
   if(!sessionPage(sender,'start',message.requestId))
     return {status:'DENIED',code:'INVALID_START_SOURCE'};
@@ -162,6 +206,8 @@ async function sessionStartPrepare(message,sender){
     return {status:'DENIED',code:'SESSION_REPLACEMENT_MISMATCH'};
   if(disk.session&&disk.session.phase!=='DONE'&&!matchingBlocked)
     return {status:'DENIED',code:'SESSION_ALREADY_ACTIVE'};
+  const capacity=await resources.admit(prior,{kind:'chat'});
+  if(!capacity.ok)return {status:'DENIED',code:capacity.code};
   // The same blocked task may never be replayed implicitly: a replacement
   // requires a new project ID and leaves the old Chat intact for audit.
   const next={sessionId:crypto.randomUUID(),projectId:intent.projectId,
@@ -195,13 +241,19 @@ async function sessionStartResult(message,sender){
     confirmed=!!tab&&pathOf(tab.url)===message.newPage;
   }
   const next={...run,phase:confirmed?'WAITING_REPLY':'BLOCKED',
+    lastStartActionTabId:sender.tab.id,
     reason:confirmed?'':'START_SEND_UNVERIFIED',
+    ...(!confirmed&&['START_HOME_URL_UNVERIFIED','NEW_CHAT_NOT_READY',
+      'FIRST_TURN_OBSERVER_UNAVAILABLE'].includes(message.failureCode)
+      ?{lastStartFailureCode:message.failureCode}:{}),
     ...(confirmed?{tabId:message.newTabId,page:message.newPage,
       newUserKey:message.newUserKey}:{attemptedNewTabId:Number.isInteger(message.newTabId)?message.newTabId:null})};
   delete next.startPrompt;
   delete next.machineRequestId;
   delete next.machineActionTabId;
   await saveRun(next);
+  if(confirmed)await resources.confirmChat(message.newTabId,next.sessionId||next.token,
+    'https://chatgpt.com'+message.newPage).catch(()=>{});
   return confirmed?{status:'OK',sessionId:next.sessionId,
     activeChatId:sessionProjection(next).activeChatId,
     activeChatUrl:sessionProjection(next).activeChatUrl}
@@ -231,6 +283,14 @@ async function sessionStatus(message,sender){
   }
   return {status:'OK',state:run.phase==='BLOCKED'?'BLOCKED':'ACTIVE',session:record};
 }
+async function expireStaleAction() {
+  const run=await readRun();
+  if(!['STARTING','RESERVED','PENDING'].includes(run?.phase)
+    || !Number.isSafeInteger(run.actionPendingAt)
+    || Date.now()-run.actionPendingAt<180000) return;
+  // No action may be recreated or re-sent on a missing receipt. Keep the Chat.
+  await saveRun({...run,phase:'BLOCKED',reason:'ACTION_RESULT_TIMEOUT_UNVERIFIED'});
+}
 async function prepareHandoffIfDue() {
   const run = await readRun();
   const deadlineAt = deadlineOf(run);
@@ -383,7 +443,7 @@ async function onTurnBlocked(message, sender) {
     try {
       const url = chrome.runtime.getURL(retry ? "continue.html" : "handoff.html")
         + "?tabId=" + previous.tabId + "&token=" + encodeURIComponent(token);
-      const actionTab = await chrome.tabs.create({url, active: false, windowId: sender.tab.windowId});
+      const actionTab = await createBoundedAction({url, active: false, windowId: sender.tab.windowId});
       return {status: "QUEUED", actionTabId: actionTab.id, code: retry ? "NATIVE_RETRY_ONCE" : "CONTEXT_HANDOFF"};
     } catch {
       await saveRun({...next, phase: "BLOCKED", reason: "ERROR_ACTION_CREATE_FAILED"});
@@ -633,7 +693,7 @@ async function onTurnFinished(message, sender) {
   try {
     const url = chrome.runtime.getURL(nextAction === "HANDOFF" ? "handoff.html" : "continue.html")
       + "?tabId=" + tabId + "&token=" + encodeURIComponent(token);
-    const actionTab = await chrome.tabs.create({url, active: false, windowId: sender.tab.windowId});
+    const actionTab = await createBoundedAction({url, active: false, windowId: sender.tab.windowId});
     return {status: "QUEUED", actionTabId: actionTab.id};
   } catch (error) {
     await saveRun({...recorded, phase: "BLOCKED", reason: "ACTION_PAGE_CREATE_FAILED"});
@@ -666,7 +726,7 @@ async function releaseCountInterval() {
   delete run.countReleaseAt;
   await saveRun(run);
   try {
-    await chrome.tabs.create({url:chrome.runtime.getURL(action === "HANDOFF"
+    await createBoundedAction({url:chrome.runtime.getURL(action === "HANDOFF"
       ? "handoff.html" : "continue.html") + "?tabId=" + old.tabId
       + "&token=" + encodeURIComponent(run.token), active:false, windowId:tab.windowId});
   } catch {
@@ -1082,6 +1142,9 @@ async function onResult(message, sender) {
   }
   if (!confirmed) delete next.modelTurnToken;
   await saveRun(next);
+  if(confirmed && run.action==="HANDOFF" && Number.isInteger(message.newTabId))
+    await resources.confirmChat(message.newTabId,next.sessionId||next.token,
+      "https://chatgpt.com"+message.newPage).catch(()=>{});
   return {status: confirmed ? "OK" : "BLOCKED"};
 }
 // Extension updates invalidate previous injected listeners. Reconnect only its own observers.
@@ -1144,7 +1207,7 @@ async function releaseWallClockHold(run) {
     wallReleasedAt: Date.now(), reason: ""};
   await saveRun(next); // reserve once, then Action page exclusively sends
   try {
-    const action = await chrome.tabs.create({
+    const action = await createBoundedAction({
       url: chrome.runtime.getURL("continue.html") + "?tabId=" + run.tabId
         + "&token=" + encodeURIComponent(token), active: false, windowId: tab.windowId
     });
@@ -1162,6 +1225,9 @@ async function ensureAlarm() {
   if (!existing) await chrome.alarms.create(ALARM_NAME, {periodInMinutes: 1});
 }
 async function watchActiveTurn() {
+  // One bounded reconciliation on the existing 1-minute Worker alarm.
+  await serial(async()=>{await expireStaleAction();
+    await resources.reconcile(await readRun()).catch(()=>{});});
   // Normal periodic wakeups also reconcile a delayed one-shot deadline.
   // All state changes share the same serial queue as Turn/Action receipts.
   await serial(async()=>{await expireStaleModelIntent();await prepareHandoffIfDue();});
@@ -1218,18 +1284,43 @@ chrome.alarms?.onAlarm?.addListener(alarm => {
 });
 chrome.runtime.onInstalled?.addListener(() => {
   void ensureAlarm();
+  void serial(async()=>{await expireStaleAction();
+    await resources.reconcile(await readRun()).catch(()=>{});});
   void reconnectOpenChats();
 });
 chrome.runtime.onStartup?.addListener(() => {
   void ensureAlarm();
+  void serial(async()=>{await expireStaleAction();
+    await resources.reconcile(await readRun()).catch(()=>{});});
   void reconnectOpenChats();
 });
 void ensureAlarm();
 // Reconcile an elapsed deadline after MV3 Worker suspension/reload.
-void serial(prepareHandoffIfDue);
+void serial(async()=>{await expireStaleAction();
+  await resources.reconcile(await readRun()).catch(()=>{});
+  await prepareHandoffIfDue();});
 // A manual extension Reload does not necessarily fire onInstalled/onStartup.
 // Reattach the two idempotent read-only scripts to existing ChatGPT tabs.
 void reconnectOpenChats();
+// User-clicked popup Clean must share the same Action quota as Worker actions.
+// The popup cannot create extra Chrome tabs directly.
+async function openPopupClean(message,sender) {
+  if(sender?.url!==chrome.runtime.getURL('popup.html')
+    ||!Number.isSafeInteger(message?.tabId)||message.tabId<=0)
+    return {status:'DENIED',code:'POPUP_SOURCE_INVALID'};
+  const target=await chrome.tabs.get(message.tabId).catch(()=>null);
+  let valid=false;
+  try {valid=target?.active===true && Number.isSafeInteger(target.windowId)
+    && new URL(target.url).origin==='https://chatgpt.com';} catch {}
+  if(!valid)return {status:'DENIED',code:'CLEAN_TARGET_UNVERIFIED'};
+  try {
+    const action=await createBoundedAction({url:chrome.runtime.getURL('clean.html')
+      +'?tabId='+target.id,windowId:target.windowId,active:true});
+    return {status:'OK',actionTabId:action.id};
+  } catch(error) {
+    return {status:'BLOCKED',code:error?.message||'CLEAN_ACTION_UNVERIFIED'};
+  }
+}
 // Read-only target resolver for a CLI-created formal Eye Action.
 // This never starts a Loop, changes Owner, or sends a chat message.
 async function onExtensionCliTarget(message,sender) {
@@ -1264,8 +1355,11 @@ chrome.runtime.onMessage.addListener((message, sender, reply) => {
     "CHAT_LOOP_ACTION_TEST_PREPARE_V1",
     "CHAT_LOOP_SESSION_START_PREPARE_V1", "CHAT_LOOP_SESSION_START_TAKE_V1",
     "CHAT_LOOP_SESSION_START_RESULT_V1", "CHAT_LOOP_SESSION_STATUS_V1",
+    "CHAT_LOOP_RESOURCE_CHAT_V1",
     "CHAT_LOOP_ACCEPTANCE_CLOCK_ADVANCE_V1"].includes(type)) {
-    const work = serial(() => type === "CHAT_LOOP_SESSION_START_PREPARE_V1"
+    const work = serial(() => type === "CHAT_LOOP_RESOURCE_CHAT_V1"
+      ? resourceChatGate(message,sender)
+      : type === "CHAT_LOOP_SESSION_START_PREPARE_V1"
       ? sessionStartPrepare(message,sender) : type === "CHAT_LOOP_SESSION_START_TAKE_V1"
       ? sessionStartTake(message,sender) : type === "CHAT_LOOP_SESSION_START_RESULT_V1"
       ? sessionStartResult(message,sender) : type === "CHAT_LOOP_SESSION_STATUS_V1"
@@ -1282,6 +1376,11 @@ chrome.runtime.onMessage.addListener((message, sender, reply) => {
     void work.then(reply, error => reply({status: "BLOCKED", code: error.message || "SCHEDULER_ERROR"}));
     return true;
   }
+  if (type === 'CHAT_LOOP_POPUP_CLEAN_OPEN_V1') {
+    void serial(()=>openPopupClean(message,sender)).then(reply,
+      ()=>reply({status:'BLOCKED',code:'CLEAN_ACTION_UNVERIFIED'}));
+    return true;
+  }
   if (type === "CHAT_LOOP_EXTENSION_TARGET_V1") {
     void onExtensionCliTarget(message,sender).then(reply,
       ()=>reply({status:"DENIED",code:"OWNER_UNVERIFIED"}));

package/extension/loop/resources.js

@@ -0,0 +1,228 @@
+// One bounded inventory for the existing Extension Worker. It never sends,
+// types into, or otherwise drives a ChatGPT page.
+(() => {
+  const KEY = 'chat-loop.resources.v1';
+  const ACTION_LIMIT = 3; // Includes machine Eye, Start, manual and timed Actions.
+  const CHAT_LIMIT = 2; // One owner plus at most one Handoff successor.
+  const AUDIT_TTL = 60_000;
+  const READ_TTL = 180_000;
+  const TERMINAL_TTL = 30_000;
+  const READ_ONLY = new Set(['status','text','dom','screenshot','reload']);
+  const ACTIONS = new Set(['start','continue','handoff','status','text','dom',
+    'screenshot','reload','clean','clock']);
+  const validId = s => /^[a-f0-9]{32}$/.test(s || '');
+  const validTabId = s => /^[1-9][0-9]*$/.test(s || '');
+  const extensionBase = () => chrome.runtime.getURL('');
+  function classify(tab) {
+    if (!Number.isInteger(tab?.id) || !tab.url) return null;
+    let u;
+    try {u = new URL(tab.url);} catch {return null;}
+    if (u.protocol !== 'chrome-extension:' || !tab.url.startsWith(extensionBase())
+      || u.host !== new URL(extensionBase()).host) return null;
+    if (u.pathname === '/popup.html' && u.search === '?audit=1')
+      return {kind:'audit'};
+    if (u.pathname === '/popup.html' && u.searchParams.size === 1) {
+      const name=[...u.searchParams.keys()][0],value=u.searchParams.get(name);
+      const noId=new Set(['newTest','cleanup','cleanupVerified','cleanupStaleMachine']);
+      const tabId=new Set(['cleanupTestHome','cleanupFailedStartHome']);
+      if ((noId.has(name)&&value==='1') || (tabId.has(name)&&validTabId(value)))
+        return {kind:'manual',name:'acceptance'};
+    }
+    const name = u.pathname.match(/^\/(start|continue|handoff|status|text|dom|screenshot|reload|clean|clock)\.html$/)?.[1];
+    if (!ACTIONS.has(name)) return null;
+    if (u.searchParams.size === 1 && validId(u.searchParams.get('requestId')))
+      return {kind:READ_ONLY.has(name) || ['continue','handoff'].includes(name)
+        ? 'read-only' : 'machine', name, requestId:u.searchParams.get('requestId')};
+    if (['continue','handoff'].includes(name)
+      && u.searchParams.size === 2 && validTabId(u.searchParams.get('tabId'))
+      && /^[0-9a-f-]{36}$/i.test(u.searchParams.get('token') || ''))
+      return {kind:'send', name, token:u.searchParams.get('token'),
+        targetId:Number(u.searchParams.get('tabId'))};
+    // Manual pages count toward the quota but are never automatically closed.
+    return {kind:'manual', name};
+  }
+  const initial = () => ({created:0, observed:0, closed:0, denied:0,
+    peakActions:0, peakChats:0, lastDenial:null, entries:[]});
+  const load = async () => {
+    const value=(await chrome.storage.local.get(KEY))[KEY];
+    return value && Array.isArray(value.entries) ? value : initial();
+  };
+  const save = state => chrome.storage.local.set({[KEY]:state});
+  const cleanEntry = x => x && Number.isInteger(x.id) && typeof x.url === 'string';
+  const safeRemove = async (tab,entry,state,reason) => {
+    const live=await chrome.tabs.get(tab.id).catch(()=>null);
+    if (!live || live.url !== entry.url || live.active || live.pinned) return false;
+    await chrome.tabs.remove(tab.id);
+    state.closed++;
+    state.lastReaped={id:tab.id, reason, at:Date.now()};
+    state.entries=state.entries.filter(e=>e.id!==tab.id);
+    return true;
+  };
+  const noDraft = async tabId => {
+    try {
+      const [p]=await chrome.scripting.executeScript({target:{tabId},func:()=>{
+        if (location.origin !== 'https://chatgpt.com' || !/^\/c\/[0-9a-f-]{12,}$/i.test(location.pathname)) return false;
+        const editor=document.querySelector('[contenteditable="true"][data-composer-markdown]')
+          ||document.querySelector('#prompt-textarea[contenteditable="true"]');
+        return !!editor && !(editor.innerText || editor.textContent || '').trim()
+          && !document.querySelector('[data-testid*="attachment-preview"], [data-testid*="image-preview"], [data-testid="composer-attachment"]');
+      }});
+      return p?.result===true;
+    } catch {return false;}
+  };
+  async function reconcile(run, {reap=true}={}) {
+    const state=await load(),now=Date.now();
+    const all=await chrome.tabs.query({});
+    const live=new Map(all.filter(t=>Number.isInteger(t.id)).map(t=>[t.id,t]));
+    const kept=[];
+    for (const entry of state.entries.filter(cleanEntry)) {
+      const tab=live.get(entry.id);
+      if (!tab || tab.url!==entry.url && entry.kind!=='chat') {
+        if (!tab) state.closed++;
+        continue;
+      }
+      // A Chat URL may change from blank to canonical only via markConfirmed.
+      if (entry.kind==='chat' && tab.url!==entry.url) {
+        kept.push(entry);continue; // Preserve provenance; never delete on unknown navigation.
+      }
+      kept.push(entry);
+    }
+    state.entries=kept;
+    for (const tab of all) {
+      const info=classify(tab);
+      if (!info || state.entries.some(e=>e.id===tab.id)) continue;
+      state.entries.push({id:tab.id,url:tab.url,kind:'action',type:info.kind,
+        name:info.name||null,firstSeenAt:now,owned:false});
+      state.observed++;
+    }
+    // A crashed Action may have created a Chat before calling registerChat.
+    // Chrome's trusted openerTabId lets us recover that exact provenance,
+    // including after an MV3 Worker restart. Unknown other Chats are not owned.
+    for (const tab of all) {
+      if (!Number.isInteger(tab.id)||!Number.isInteger(tab.openerTabId)
+        || !/^https:\/\/chatgpt\.com\/(?:|c\/[0-9a-f-]{12,})$/i.test(tab.url||'')
+        || state.entries.some(e=>e.id===tab.id)) continue;
+      const opener=live.get(tab.openerTabId), proof=classify(opener);
+      const exactStart=proof?.name==='start' && proof.kind==='machine'
+        && [run?.machineActionTabId,run?.lastStartActionTabId].includes(opener?.id);
+      const exactHandoff=proof?.name==='handoff' && proof.kind==='send'
+        && proof.token===run?.token
+        && [run?.tabId,run?.sourceTabId].includes(proof.targetId);
+      if ((!exactStart&&!exactHandoff)||!(run?.sessionId||run?.token)) continue;
+      state.entries.push({id:tab.id,url:tab.url,kind:'chat',
+        sessionId:run.sessionId||run.token,firstSeenAt:now,confirmed:false,
+        testOwned:/^cl-intent-e2e-[a-z0-9-]+$/i.test(run.projectId||'')});
+      state.observed++;state.created++;
+    }
+    if (reap) {
+      for (const entry of [...state.entries]) {
+        const tab=live.get(entry.id);
+        if (!tab || tab.active || tab.pinned) continue;
+        const age=now-(entry.firstSeenAt||now);
+        if (entry.kind==='action') {
+          const info=classify(tab);
+          if (!info || tab.url!==entry.url) continue;
+          if (info.kind==='audit' && age>=AUDIT_TTL)
+            await safeRemove(tab,entry,state,'STALE_AUDIT');
+          else if (info.kind==='read-only' && age>=READ_TTL)
+            await safeRemove(tab,entry,state,'STALE_READ_ONLY_NO_SEND');
+          else if (info.kind==='send' && age>=TERMINAL_TTL
+            && ['DONE','BLOCKED'].includes(run?.phase)
+            && run?.token===info.token
+            && [run.tabId,run.sourceTabId].includes(info.targetId))
+            await safeRemove(tab,entry,state,'CONFIRMED_TERMINAL_ACTION');
+          else if (info.kind==='machine' && info.name==='start'
+            && age>=TERMINAL_TTL && ['DONE','BLOCKED'].includes(run?.phase)
+            && [run?.lastStartActionTabId,run?.machineActionTabId].includes(tab.id))
+            await safeRemove(tab,entry,state,'CONFIRMED_TERMINAL_START');
+        } else if (entry.kind==='chat' && entry.confirmed
+          && entry.testOwned===true && entry.terminal==='DONE' && age>=TERMINAL_TTL
+          && tab.url===entry.url && await noDraft(tab.id)) {
+          await safeRemove(tab,entry,state,'DONE_OWNED_CHAT');
+        }
+      }
+    }
+    // Count every live matching page, even when the bounded evidence index
+    // cannot retain every item after an external flood of manual pages.
+    const after=await chrome.tabs.query({});
+    const actionCount=after.filter(t=>classify(t)).length;
+    const afterIds=new Set(after.map(t=>t.id));
+    const chatCount=state.entries.filter(e=>e.kind==='chat'
+      && afterIds.has(e.id)).length;
+    const unownedHomes=after.filter(t=>t.url==='https://chatgpt.com/'
+      && !state.entries.some(e=>e.kind==='chat'&&e.id===t.id)).length;
+    state.peakActions=Math.max(state.peakActions,actionCount);
+    state.peakChats=Math.max(state.peakChats,chatCount);
+    // Retain tracked Chats first: evicting their provenance would weaken the
+    // quota and could make an unknown send appear safe to replay.
+    const chatEntries=state.entries.filter(e=>e.kind==='chat');
+    const actionEntries=state.entries.filter(e=>e.kind==='action');
+    const slots=Math.max(0,32-chatEntries.length);
+    state.entries=[...chatEntries,...(slots?actionEntries.slice(-slots):[])];
+    // Native/manual pages remain counted directly from the browser snapshot.
+    state.current={actions:actionCount,chats:chatCount,
+      unownedHomes,totalTabs:after.length,at:now};
+    await save(state);
+    return {state,actionCount,chatCount,unownedHomes};
+  }
+  async function admit(run,{kind='action'}={}) {
+    const {state,actionCount,chatCount,unownedHomes}=await reconcile(run);
+    const blocked=actionCount+(kind==='action'?1:0)>ACTION_LIMIT
+      ? 'RESOURCE_ACTION_LIMIT' : chatCount+unownedHomes+(kind==='chat'?1:0)>CHAT_LIMIT
+        ? 'RESOURCE_CHAT_LIMIT' : null;
+    if (blocked) {
+      state.denied++;state.lastDenial={code:blocked,at:Date.now()};
+      await save(state);
+    }
+    return blocked?{ok:false,code:blocked,actionCount,chatCount}
+      :{ok:true,actionCount,chatCount};
+  }
+  async function registerAction(tab) {
+    if (!classify(tab)) return false;
+    const state=await load();
+    if (!state.entries.some(e=>e.id===tab.id)) {
+      state.entries.push({id:tab.id,url:tab.url,kind:'action',
+        type:classify(tab).kind,firstSeenAt:Date.now(),owned:true});
+      state.created++;
+      // Fast actions can finish before the next alarm/reconciliation. Count
+      // their observed creation in peak metrics even if no later scan sees them.
+      state.peakActions=Math.max(state.peakActions,
+        state.entries.filter(e=>e.kind==='action').length);
+      await save(state);
+    }
+    return true;
+  }
+  async function registerChat(tab,run) {
+    if (!Number.isInteger(tab?.id) || tab.url!=='https://chatgpt.com/'
+      || !(run?.sessionId || run?.token) || run.phase!=='PENDING') return false;
+    const state=await load();
+    const existing=state.entries.find(e=>e.id===tab.id);
+    if(existing)return existing.kind==='chat'
+      &&existing.sessionId===(run.sessionId||run.token);
+    state.entries.push({id:tab.id,url:tab.url,kind:'chat',
+      sessionId:run.sessionId||run.token,firstSeenAt:Date.now(),confirmed:false,
+      testOwned:/^cl-intent-e2e-[a-z0-9-]+$/i.test(run.projectId||'')});
+    state.created++;
+    state.peakChats=Math.max(state.peakChats,
+      state.entries.filter(e=>e.kind==='chat').length);
+    await save(state);
+    return true;
+  }
+  async function confirmChat(id,sessionId,url) {
+    const state=await load();
+    const entry=state.entries.find(e=>e.id===id&&e.kind==='chat'
+      &&e.sessionId===sessionId);
+    if (!entry || !/^https:\/\/chatgpt\.com\/c\/[0-9a-f-]{12,}$/i.test(url)) return;
+    entry.url=url;entry.confirmed=true;
+    await save(state);
+  }
+  async function terminal(run) {
+    if (!(run?.sessionId||run?.token) || !['DONE','BLOCKED'].includes(run.phase)) return;
+    const state=await load();
+    for(const entry of state.entries) if(entry.kind==='chat'
+      &&entry.sessionId===(run.sessionId||run.token)) entry.terminal=run.phase;
+    await save(state);
+  }
+  globalThis.ChatLoopResourcesV1=Object.freeze({reconcile,admit,registerAction,
+    registerChat,confirmChat,terminal,KEY,ACTION_LIMIT,CHAT_LIMIT});
+})();

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Chat Loop Extension",
-  "version": "0.3.37",
+  "version": "0.3.44",
   "description": "Chat Loop browser companion: Eye actions, Turn observer, Continue and Handoff Actions",
   "permissions": [
     "activeTab",

package/extension/popup.js

@@ -76,6 +76,8 @@ document.getElementById('clean-action').addEventListener('click',async()=>{
   if(!selected?.id||!selected?.url?.startsWith('https://chatgpt.com/')){
     show('CLEAN_NOT_AVAILABLE','请先选中要清理的 ChatGPT 标签页。');return;
   }
-  await chrome.tabs.create({url:chrome.runtime.getURL('clean.html?tabId='+selected.id),
-    windowId:selected.windowId,active:true});
+  const opened=await chrome.runtime.sendMessage({
+    type:'CHAT_LOOP_POPUP_CLEAN_OPEN_V1',tabId:selected.id}).catch(()=>null);
+  if(opened?.status!=='OK')
+    show('CLEAN_BLOCKED',opened?.code||'CLEAN_ACTION_UNVERIFIED');
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/chatloop-extension",
-  "version": "0.3.37",
+  "version": "0.3.44",
   "type": "module",
   "description": "Chat Loop Extension package: nine formal Action pages and its own native CLI bridge",
   "bin": {