fix(extension): cross-origin nav must update daemon's lastActiveTab — §2C(iv)

[LeonTing1010]

Summary

CDD Phase 7 post-merge fix. §2C(iii) shipped in PR #5 opens a new bg tab for cross-origin nav, but chrome.tabs.create({active:false}) doesn't trigger chrome.tabs.onActivated, so the daemon's lastActiveTab cache stays stale. Subsequent ops in the same plan silently route to the OLD active tab.

Symptom

Real dogfood 2026-05-09 (after merging PR #5):

Plan A: ahrefs/taprun_wa  → tab 1692089668 (Ahrefs)
Plan B: cursor/taprun_check (cross-origin)
  - nav opens new tab 1692089671 (cursor.directory) ✓ (§2C(iii) worked)
  - eval result: bodyText, title, url all from tab 1692089668 (Ahrefs!) ✗

The page object correctly shows the new cursor tab, but the eval result was injected into the OLD Ahrefs tab.

Root cause

active_tab_changed is sent via chrome.tabs.onActivated listener (line ~1430). When chrome.tabs.create({active:false}) is used, the new tab is NOT activated, so onActivated doesn't fire, and daemon's lastActiveTab stays at the previous tab.

The existing lastActiveTab fallback at line ~1364 then routes the next op to the OLD tab.

Fix

In the §2C(ii)/(iii) chrome.tabs.create branch, manually emit active_tab_changed to ws when fromDaemon=true. Daemon's cache catches up; subsequent ops route correctly.

if (isInternal || crossOrigin) {
  const tab = await chrome.tabs.create({ url: params.url, active: false })
  tabId = tab.id
  // §2C(iv) post-merge fix
  if (fromDaemon && ws && ws.readyState === WebSocket.OPEN) {
    ws.send(JSON.stringify({
      jsonrpc: '2.0',
      method: 'active_tab_changed',
      params: { tabId, url: params.url },
    }))
  }
}

Static guards (Rule iv in self-heal.test.mjs)

• iv/1: chrome.tabs.create branch sends active_tab_changed
• iv/2: emit is gated on fromDaemon (popup path unaffected)

CDD verification

• RED (post-mortem of merged PR feat(extension): self-heal — MV3 SW keep-alive + chrome:// uniform handling #5): 1 fail (Rule iv/1 — emit absent)
• GREEN: 10/10 (8 from §2C i+ii+iii + 2 new for §2C iv)
• Regression: architecture (17/17) + protocol (32/32) + multi-tab (15/15) + self-heal (10/10) + tap-format + wire_codes — no regressions

Phase 7 learning

Source-text tests verified the STATIC shape (new tab created on cross-origin) but couldn't verify the DYNAMIC tab routing across daemon-driven multi-op plans. Real dogfood exposed the gap between "new tab opened" and "subsequent ops route to it". Rule (iv) closes the static guard at the same layer (source-text proxy for the runtime behavior). Per CDD v3 §7: the new RED test was added BEFORE the implementation fix, then the audit note explains why the original §2C(iii) tests passed despite this gap.

Real-world verification

After merge + reload extension:

1. Re-run cursor/taprun_check immediately after ahrefs/taprun_wa
2. Eval result should contain cursor.directory content (NOT Ahrefs)

🤖 Generated with Claude Code