feat: resilient MDB browser pool and ChatGPT extension status

[alexanderradahl]

Summary

Makes the MDB background-browser pool resilient under concurrent ChatGPT/automation workloads, adds a safe read-only interoperability surface for the installed ChatGPT Chrome extension, and improves chrome_click for modern custom controls.

Resilient MDB workspace

• raises the default managed pool target from 4 to 8 tabs
• existing smaller pools self-expand only when Chrome is already naturally foreground
• chrome_open waits up to 20 seconds for a slot instead of immediately returning CHROME_WORKSPACE_EXHAUSTED
• leases carry leasedAt + lastActivityAt; navigate/snapshot/click/fill renew the heartbeat
• leases idle for 10 minutes are reclaimed and reset to the extension-owned idle page
• v0.2.3 leases migrate safely on first reconciliation instead of being mistaken for stale work
• workspace mutations are serialized to prevent concurrent sessions from reserving the same tab
• release resets a tab before making it available again, preventing cleanup/navigation races
• workspace release is grantless local cleanup, so Strict-mode URL grant expiry cannot strand leases
• transport timeout grows to 45s to cover 20s queue wait + up to 15s navigation

More realistic background clicks

A live G2 Digital Markets signup flow exposed that its Department selector listens on mousedown, while MDB previously only called DOM .click().

chrome_click now:

• validates target existence, disabled state, and visibility
• scrolls/centers the target without activating Chrome
• emits pointerover, mouseover, pointermove, mousemove, pointerdown, mousedown, focus, pointerup, and mouseup
• finishes with native element.click() activation for normal button/link/input behavior
• returns its strategy, coordinates, event sequence, and trusted: false

This intentionally does not add Chrome's broad debugger permission. Synthetic events remain isTrusted=false; true trusted-user-gesture browser security boundaries remain manual rather than being bypassed.

ChatGPT Chrome extension status

Adds read-only chatgpt_extension_status on macOS. It reports:

• installed official ChatGPT Chrome extension version/manifest metadata
• local com.openai.codexextension native-host registration/allowlist metadata
• live status from OpenAI's existing chatgpt.com page bridge when a ChatGPT tab is open

This deliberately does not patch the OpenAI extension, modify its native-host allowlist, expose arbitrary private OpenAI JSON-RPC methods, or programmatically open its side panel. The installed OpenAI extension has no externally_connectable contract and the side-panel path requires a trusted user gesture.

Why

A real automation run hit CHROME_WORKSPACE_EXHAUSTED because Apollo, G2, and two Salesforge workflows legitimately occupied all four managed tabs at once. Separately, the G2 flow showed that .click() alone is not enough for many modern component libraries. This PR fixes both classes of ordinary browser reliability failure while preserving background/no-focus behavior and browser security boundaries.

Validation

• full npm test green
• live MDB PID remained alive and live unlock file remained present across full suite
• node tests/chrome-background.mjs
• node tests/smoke.mjs
• npm run check
• Swift menu-bar typecheck
• npm pack --dry-run --json
• shasum -a 256 -c SHA256SUMS (exact 53/53 tracked-file coverage)
• git diff --check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.