Brandon LiandClaude Opus 5
54221bbc0c
Builds the pipeline the autobuyer needs: see the page, find an element, click it. extension/ — MV3 Chromium extension. Polls /api/autobuyer/status and, while on, scrapes the target tab's HTML and posts it back. Also serves locate requests: focuses the window, scrolls the element into view, and reports its position. host_permissions is scoped to tradeify plus localhost so it cannot read other sites — an empty target pattern would otherwise capture whatever tab happened to be active, including banking or mail. app/api/autobuyer/ — status toggle, capture store, and the locate request queue. CORS is open because the extension's origin changes every time an unpacked extension is reloaded. app/autobuyer/page.tsx — ON switch, source view (default) and a rendered view. The render uses sandbox="allow-scripts" without allow-same-origin: the page's own JS is needed because sites ship content at opacity:0 and fade it in, but the frame must not reach the dashboard's same-origin API routes, which serve firm credentials. clicker/ — Python CLI. Asks the extension where a selector is, adds the element rect to the window's screen position and the browser chrome height to get desktop coordinates, then clicks with a human motion model (curved path, eased velocity, occasional overshoot, dwell before press). Raises the browser application first, since macOS consumes a click on an unfocused window rather than delivering it. Refuses to click when the element is covered by an overlay, when the coordinates fall off-screen, or when the browser cannot be confirmed frontmost. Verified: API round-trips, capture pruning, locate claim-once semantics, motion geometry and timing, and focus activation — the last two against stubs, since pyautogui and pyobjc are not installed here. NOT verified end to end: Chrome is still running a stale build of the extension, so a locate request has never completed against a real page and no real click has been sent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.3 KiB
2.3 KiB
AutoFirmer Capture (Chromium extension)
Polls the dashboard for an on/off flag and, while it's on, scrapes the target tab's HTML and posts it back to the dashboard.
Install (unpacked)
- Start the dashboard (
npm run dev) sohttp://localhost:3000is up. - Open
chrome://extensions, enable Developer mode (top right). - Load unpacked → select this
extension/folder. - Click the extension icon to open the popup and set:
- Dashboard URL — default
http://localhost:3000. Use the VPS IP if the dashboard runs elsewhere. - Poll interval — seconds between status checks (default 3).
- Target URL pattern — a Chrome match pattern like
https://*.tradovate.com/*. Leave blank to capture whichever tab is active. - Element selector — optional CSS selector; matching elements get their on-screen position measured alongside the HTML.
- Dashboard URL — default
The badge shows ON (green) while capturing, ! (red) if the dashboard is
unreachable, and nothing when the switch is off.
Flow
AutoBuyer page --PATCH /api/autobuyer/status--> SQLite settings
extension --GET /api/autobuyer/status--> { enabled }
extension --POST /api/autobuyer/capture-> html + viewport + element rects
AutoBuyer page --GET /api/autobuyer/capture-> renders the HTML
Scope
host_permissions is deliberately narrow — https://*.tradeify.co/* plus localhost
for the dashboard. The extension is technically incapable of reading any other site,
so an accidental capture of your bank or mail tab can't happen. The default
Target URL pattern matches, so it only ever captures the broker tab regardless
of which tab is focused.
To automate a different broker, add its pattern to host_permissions in
manifest.json, update the popup's target pattern, and reload the extension. Avoid
going back to <all_urls> — that re-enables scraping whatever tab is active.
Notes
- The extension never captures the dashboard's own pages — otherwise it would just mirror its own output back.
chrome://,about:and Web Store pages cannot be scripted by any extension; they're skipped.- MV3 service workers are torn down when idle. Each poll makes an extension API call, which keeps the worker alive; a 30-second alarm revives it if Chrome kills it anyway. So worst-case cadence is 30s, normal cadence is the poll interval.