Let the master dashboard drive this instance; drop the AutoBuyer switch

Three changes that ride together because they touch the same surface.

A control link to the master. lib/master-link.ts dials out to
<master>/ws/instance and holds it open, so the dashboard can trigger a trade or
queue an AutoBuyer run here. Commands call the same functions the local pages
call — runTrade, startScheduler, queueRun — so nothing reaches the broker by a
path the UI does not also use. Reports prefer the socket and fall back to the
existing POST, which keeps older masters working unchanged.

startMasterLink is idempotent, and that matters more than it looks: getClients()
is lazy and starts the link, so the first command re-enters it from inside a
command the live socket is waiting to ack. Tearing the socket down there loses
the ack and reports a trade that actually executed as a failure — which invites
pressing the button twice.

queueRun is lifted out of the automations route so the socket and HTTP share one
copy of the input clamping that decides how many times a purchase fires.

Page capture loses its switch and gains a scope. It now runs every tick, but
only against the active tab of the last-focused window that matches
host_permissions — so it follows the page in front of you and stops when you
switch away, where before it would fall back to any firm tab left open in the
background.

autobuyer_enabled is gone entirely. The AutoBuyer is ready whenever the runner
is; a run happens because someone asked for one. That does mean a queued run
executes as soon as clicker/runner.py claims it, with no second gate — stopping
the runner is now the way to make a machine idle.

Extension to 0.10.0; it needs a manual reload at chrome://extensions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/api/autobuyer/automations/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
-import { FIRMS, findAutomation, automationKey, describeStep, resolveSteps } from '@/lib/automations';
-import { createRun, getSetting } from '@/lib/db';
+import { FIRMS, automationKey, describeStep } from '@/lib/automations';
+import { queueRun, QueueRunError } from '@/lib/queue-run';
 import { corsJson, corsPreflight } from '../cors';
 
 /** The dashboard renders a tab per firm, and a button per automation inside it. */
@@ -30,38 +30,12 @@ export async function POST(req: NextRequest) {
         if (typeof body.automationId !== 'string') {
             return corsJson({ error: '`automationId` is required' }, { status: 400 });
         }
-        const found = findAutomation(body.automationId);
-        if (!found) {
-            return corsJson({ error: `No automation "${body.automationId}"` }, { status: 404 });
-        }
-        if (found.automation.steps.length === 0) {
-            return corsJson({ error: `"${found.automation.label}" has no steps yet` }, { status: 400 });
-        }
-        // The dashboard switch is the master arm for anything that drives the mouse.
-        if (getSetting('autobuyer_enabled') !== '1') {
-            return corsJson({ error: 'AutoBuyer is switched off' }, { status: 409 });
-        }
 
-        // Clamp every input to what the automation declared. The count decides how
-        // many times a purchase runs, so it is not taken on trust from the client.
-        const supplied = (body.inputs ?? {}) as Record<string, unknown>;
-        const inputs: Record<string, number> = {};
-        for (const declared of found.automation.inputs ?? []) {
-            const raw = Number(supplied[declared.id]);
-            const value = Number.isFinite(raw) ? Math.floor(raw) : declared.default;
-            inputs[declared.id] = Math.min(declared.max, Math.max(declared.min, value));
-        }
-
-        let resolved;
-        try {
-            resolved = resolveSteps(found.firm, found.automation, inputs);
-        } catch (err: any) {
-            return corsJson({ error: err?.message ?? 'Could not expand the steps' }, { status: 400 });
-        }
-
-        const run = createRun(body.automationId, resolved.length, inputs);
-        return corsJson({ runId: run.id, totalSteps: run.total_steps, inputs });
+        return corsJson(queueRun(body.automationId, (body.inputs ?? {}) as Record<string, unknown>));
     } catch (err: any) {
+        if (err instanceof QueueRunError) {
+            return corsJson({ error: err.message }, { status: err.status });
+        }
         return corsJson({ error: err?.message ?? 'Failed to queue run' }, { status: 500 });
     }
 }

app/api/autobuyer/runs/claim/route.ts

@@ -1,14 +1,10 @@
-import { claimRun, getSetting } from '@/lib/db';
+import { claimRun } from '@/lib/db';
 import { findAutomation, resolveSteps, resolveAuthSteps } from '@/lib/automations';
 import { corsJson, corsPreflight } from '../../cors';
 
 /** The Python runner polls this. Returns the run plus the steps to execute, so
  *  the runner never needs its own copy of the automation definitions. */
 export async function POST() {
-    if (getSetting('autobuyer_enabled') !== '1') {
-        return corsJson({ run: null, reason: 'AutoBuyer is switched off' });
-    }
-
     const row = claimRun();
     if (!row) return corsJson({ run: null });
 

app/api/autobuyer/status/route.ts

@@ -1,29 +1,11 @@
-import { NextRequest } from 'next/server';
-import { getSetting, setSetting, countPendingLocate } from '@/lib/db';
+import { countPendingLocate } from '@/lib/db';
 import { corsJson, corsPreflight } from '../cors';
 
 /** Polled by the Chromium extension every few seconds, and by the AutoBuyer page.
- *  `pendingLocate` rides along so the extension learns about queued clicks without
- *  a second request on every tick. */
+ *  The AutoBuyer has no on/off switch — it is ready whenever the runner is — so
+ *  the only thing worth reporting here is whether clicks are waiting to be served. */
 export async function GET() {
-    return corsJson({
-        enabled: getSetting('autobuyer_enabled') === '1',
-        pendingLocate: countPendingLocate(),
-    });
-}
-
-/** Flipped by the ON/OFF button on the AutoBuyer page. */
-export async function PATCH(req: NextRequest) {
-    try {
-        const body = await req.json() as { enabled?: unknown };
-        if (typeof body.enabled !== 'boolean') {
-            return corsJson({ error: '`enabled` must be a boolean' }, { status: 400 });
-        }
-        setSetting('autobuyer_enabled', body.enabled ? '1' : '0');
-        return corsJson({ enabled: body.enabled });
-    } catch (err: any) {
-        return corsJson({ error: err?.message ?? 'Failed to set status' }, { status: 500 });
-    }
+    return corsJson({ pendingLocate: countPendingLocate() });
 }
 
 export async function OPTIONS() {