🍕 Window Globals tab — surface configured window.* values in the panel

[jjpaulino]

Summary

Adds a new Globals panel tab that surfaces user-configured top-level window.* values (e.g. nymGtmPage, dataLayer) as syntax-highlighted JSON. Configured per install via a new Window globals section on the Options page; both objects and arrays render identically.

Reads happen on initial tab open and on explicit Refresh (per-row or tab-level). No ambient polling — zero measurable cost on the host page when the tab isn't open.

Design write-up: docs/specs/2026-05-19-window-globals-tab.md.

What's in this PR (commit-by-commit)

1. feat: add windowGlobals preference + parseWindowGlobal helper — pure types/parser slice. UserPreferences.windowGlobals: readonly string[], plus a parseWindowGlobal that accepts both nymGtmPage and window.nymGtmPage shapes and returns tagged failure reasons (empty / dotted-path / bracketed / invalid-identifier) so the Options UI can show a hint per failure mode. 18 new unit tests (parser + storage round-trip).
2. feat: add page-bridge for reading window globals from main world — content scripts run in an isolated world; this commit adds the bridge that injects a one-time <script> into the host page's main world. Persistent listener + correlation-ID-routed Promises so concurrent Refreshes can't cross-talk. Forged messages and bad-source iframes are dropped. Times out at 1s with a clean bridge-unavailable fallback for strict-CSP / Trusted-Types pages instead of hanging forever. 8 new tests.
3. feat(options): add 'Window globals' editor section — add/remove rows, inline per-row validation that only shows after the user has typed something, draft state kept separate from persisted state so invalid rows don't make valid siblings disappear, single-shot hydration on the first prefsLoaded transition (re-hydrating on every change would clobber the row the user is typing).
4. feat(panel): add Globals tab with refresh + collapsible cards — the actual tab. Each configured global is one <details> card (collapsed by default), with a one-line shape summary on the header (object · 14 keys, array · 7 items), a per-row Refresh button, a Copy-pretty-printed-JSON button, and a tab-level "Refresh all". Body is only mounted once expanded so huge dataLayer payloads don't pay the syntax-highlight cost until requested. Reuses the .cs-jsonld-* class family so the visual language matches the SEO tab's JSON-LD viewer. 12 new format-helper tests.
5. docs: document the Window Globals tab in README + PRIVACY — Highlights bullet, Usage table row, full Configuration subsection (input contract, refresh model, every failure message the panel can show). PRIVACY paragraph spelling out the page-bridge mechanism (only configured keys, only on user action).

Failure handling (surfaced inline in each row)

Reason	Card border tint	Message shown
undefined	warn (yellow)	(not defined on this page)
not-serializable	danger (red)	(value is not JSON-serializable — likely a function or Symbol)
serialize-error	danger	(could not serialize: <underlying message>)
access-error	danger	(reading the global threw: <underlying message>)
bridge-unavailable	warn	(could not read from this page — strict CSP or page never responded)

undefined and bridge-unavailable get the neutral warn tint because neither is actually a bug — just a missing global or a strict-CSP page.

Why inline-string bridge (vs chrome.scripting MAIN-world or a separate WAR file)

• chrome.scripting.executeScript({ world: 'MAIN' }) requires Firefox 128+; our strict_min_version is 121, so it would silently no-op on older Firefox.
• A separate web_accessible_resource means an extra Vite build entry, hashed filenames the content script has to resolve via chrome.runtime.getURL, and divergent WAR semantics between Chromium and Firefox. For ~30 lines of bridge code it's the wrong trade.
• CSP / Trusted-Types edge cases are caught and surfaced as bridge-unavailable rather than a silent hang.

Permissions

None added. The bridge runs entirely inside the existing content-script context — no scripting permission, no host changes.

Test plan

• npm run validate — typecheck + lint + format:check + 210 tests, all green
• npm run release:dry:both — both Chromium and Firefox zips build cleanly
• Verified the bundled content script chunk contains the clay-slip:globals:request bridge protocol
• Verified the Firefox manifest still has the gecko id + strict_min_version: 121.0
• Local smoke-test on a real Clay page (reviewer): load unpacked, add nymGtmPage in Options, open Globals tab, expand the row, verify JSON renders, click Refresh, verify the bridge re-reads
• Strict-CSP smoke-test (reviewer, optional): visit a page with script-src 'self', expect bridge-unavailable placeholder per row, not a stuck spinner

Screenshots

TODO before merge:

1. Options page — the new "Window globals" section with a row entered.
2. Globals tab — happy path — two configured globals, one expanded showing the JSON tree.
3. Globals tab — failure modes — at least one (not defined on this page) row so reviewers see the neutral-warn tint.

Made with Cursor