# AutoFirmer Capture (Chromium extension)

Polls the dashboard for an on/off flag and, while it's on, scrapes the target
tab's HTML and posts it back to the dashboard.

## Install (unpacked)

1. Start the dashboard (`npm run dev`) so `http://localhost:3000` is up.
2. Open `chrome://extensions`, enable **Developer mode** (top right).
3. **Load unpacked** → select this `extension/` folder.
4. Click the extension icon to open the popup and set:
   - **Dashboard URL** — default `http://localhost:3000`. Use the VPS IP if the
     dashboard runs elsewhere.
   - **Poll interval** — seconds between status checks (default 3).
   - **Target URL pattern** — a Chrome match pattern like
     `https://*.tradovate.com/*`. Leave blank to capture whichever tab is active.
   - **Element selector** — optional CSS selector; matching elements get their
     on-screen position measured alongside the HTML.

The badge shows `ON` (green) while capturing, `!` (red) if the dashboard is
unreachable, and nothing when the switch is off.

## Flow

```
AutoBuyer page  --PATCH /api/autobuyer/status-->  SQLite settings
extension       --GET   /api/autobuyer/status-->  { enabled }
extension       --POST  /api/autobuyer/capture->  html + viewport + element rects
AutoBuyer page  --GET   /api/autobuyer/capture->  renders the HTML
```

## Scope

`host_permissions` is deliberately narrow — `https://*.tradeify.co/*` plus localhost
for the dashboard. The extension is technically incapable of reading any other site,
so an accidental capture of your bank or mail tab can't happen. The default
**Target URL pattern** matches, so it only ever captures the broker tab regardless
of which tab is focused.

To automate a different broker, add its pattern to `host_permissions` in
`manifest.json`, update the popup's target pattern, and reload the extension. Avoid
going back to `<all_urls>` — that re-enables scraping whatever tab is active.

## Notes

- The extension never captures the dashboard's own pages — otherwise it would
  just mirror its own output back.
- `chrome://`, `about:` and Web Store pages cannot be scripted by any extension;
  they're skipped.
- MV3 service workers are torn down when idle. Each poll makes an extension API
  call, which keeps the worker alive; a 30-second alarm revives it if Chrome
  kills it anyway. So worst-case cadence is 30s, normal cadence is the poll
  interval.