Files

T

Brandon LiandClaude Opus 5 25289cb9b3 Let the master dashboard drive this instance; drop the AutoBuyer switch

Three changes that ride together because they touch the same surface.

A control link to the master. lib/master-link.ts dials out to
<master>/ws/instance and holds it open, so the dashboard can trigger a trade or
queue an AutoBuyer run here. Commands call the same functions the local pages
call — runTrade, startScheduler, queueRun — so nothing reaches the broker by a
path the UI does not also use. Reports prefer the socket and fall back to the
existing POST, which keeps older masters working unchanged.

startMasterLink is idempotent, and that matters more than it looks: getClients()
is lazy and starts the link, so the first command re-enters it from inside a
command the live socket is waiting to ack. Tearing the socket down there loses
the ack and reports a trade that actually executed as a failure — which invites
pressing the button twice.

queueRun is lifted out of the automations route so the socket and HTTP share one
copy of the input clamping that decides how many times a purchase fires.

Page capture loses its switch and gains a scope. It now runs every tick, but
only against the active tab of the last-focused window that matches
host_permissions — so it follows the page in front of you and stops when you
switch away, where before it would fall back to any firm tab left open in the
background.

autobuyer_enabled is gone entirely. The AutoBuyer is ready whenever the runner
is; a run happens because someone asked for one. That does mean a queued run
executes as soon as clicker/runner.py claims it, with no second gate — stopping
the runner is now the way to make a machine idle.

Extension to 0.10.0; it needs a manual reload at chrome://extensions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-30 22:31:31 -05:00

2.7 KiB

Raw Blame History

AutoFirmer Capture (Chromium extension)

Scrapes the firm tab you are looking at and posts its HTML back to the dashboard. There is no on/off switch for that — see Scope below for what limits it instead.

Install (unpacked)

Start the dashboard (npm run dev) so http://localhost:3000 is up.
Open chrome://extensions, enable Developer mode (top right).
Load unpacked → select this extension/ folder.
Click the extension icon to open the popup and set:
- Dashboard URL — default http://localhost:3000. Use the VPS IP if the dashboard runs elsewhere.
- Poll interval — seconds between status checks (default 3).
- Element selector — optional CSS selector; matching elements get their on-screen position measured alongside the HTML.

The badge shows ! (red) if the dashboard is unreachable, and nothing otherwise — blank is the working state. Open the popup for what the last tick actually did.

Flow

extension       --GET   /api/autobuyer/status-->  { pendingLocate }
extension       --POST  /api/autobuyer/capture->  html + viewport + element rects
AutoBuyer page  --GET   /api/autobuyer/capture->  renders the HTML

Nothing in that loop is switchable. Every tick serves any queued clicks and then captures the tab you are on.

Scope

Capture has no switch, so scope is what keeps it honest. Two limits, both enforced by Chrome rather than by this code:

host_permissions is deliberately narrow — the firm sites plus localhost for the dashboard. The extension is technically incapable of reading any other site, so an accidental capture of your bank or mail tab cannot happen however the logic here is changed.
Only the tab you are on. pickTab() asks for the active tab of the last-focused window and a host_permissions match. A firm tab sitting in the background is not captured, and neither is anything else. Switch away and capture simply stops until you switch back.

To automate a different broker, add its pattern to host_permissions in manifest.json and reload the extension — that alone scopes capture to it. Avoid going back to <all_urls>: it would put every tab you visit in reach, and limit 1 is the only thing standing between this and scraping your whole browser.

Notes

The extension never captures the dashboard's own pages — otherwise it would just mirror its own output back.
chrome://, about: and Web Store pages cannot be scripted by any extension; they're skipped.
MV3 service workers are torn down when idle. Each poll makes an extension API call, which keeps the worker alive; a 30-second alarm revives it if Chrome kills it anyway. So worst-case cadence is 30s, normal cadence is the poll interval.

2.7 KiB Raw Blame History