[aaron-seq]

Summary

Turning off context menus or desktop notifications previously saved the setting without changing worker behavior. The worker now applies menu changes immediately, blocks stale disabled menu clicks before extraction/AI requests, and checks notification opt-out at delivery time, including after an in-flight request and on errors.

Changes

• Serialize startup/install/settings-driven menu reconciliation; wait for callback completion and recover after API errors. Callback removal preserves Chrome 116 compatibility.
• Keep keyboard shortcuts independent of menu visibility while respecting notification opt-out.
• Change only one runtime file, background.js; no new permissions, dependencies, credentials, caches, schema, CI, or user-data deletion.
• Correct the obsolete README/research caveat and add an unreleased changelog entry. ERB decision and acceptance criteria are tracked in GitHub.

Tests

Personally run:

• npx vitest run tests/integration/extension-workflow.test.js -t 'feature preference enforcement': unchanged main fails 11 of 12 selected cases; implemented branch passes.
• npx playwright test tests/e2e/preferences.spec.js: unchanged main fails because switching menus off triggers no removal; implemented branch passes.
• npm run lint -- --max-warnings 0, npm run typecheck, npm run test:coverage: 297 tests pass (baseline 285).
• npm run test:e2e: 18 real-Chromium tests pass (baseline 17).

Coverage: 94.41% statements, 84.05% branches, 94.67% functions, 96.53% lines; worker branches 89.60% (baseline 87.50%). Thresholds are unchanged. The separate test-only red commit precedes implementation. Provider responses are mocked/intercepted. The browser regression forwards to actual menu APIs and checks completion/errors; native menu rendering and OS notification presentation are not inspected.

Audit follow-up (#34)

The unchanged baseline lockfile reproduced four development-package audit findings. A separate dependency commit patches Vitest/matching packages 4.1.11 → 4.1.12 and Vite 8.2.2 → 8.2.4. All unrelated locked versions and the package inventory are preserved; there is no new direct Vite dependency. npm ci, the complete validation above, and npm audit --audit-level=high pass with zero vulnerabilities. Advisory evidence and dependency review. The reviewed changelog now has one current Unreleased section; undated legacy notes remain clearly archived.

Risks & rollback

Low-risk preference wiring within the existing worker. Notification opt-out suppresses notices, not user-triggered AI work; popup/workspace results still render. No live provider-quality or performance claim. Revert this PR and reload the extension; settings and saved history remain unchanged.

Related

Closes #31
Closes #34

Use the GitHub issue dashboard and this PR's checks for status. Other roadmap work remains in the existing issues.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T03:58:09.685121Z	7303094	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7303094697

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".