fix: keep Chrome in MDB and isolate live bridge from tests

[alexanderradahl]

Summary

Follow-up to #8. Separates approval strictness from Chrome routing and fixes the test-isolation bug that was revoking the live menu-bar bridge unlock after npm test.

Always route Chrome through MDB

• direct Chrome AppleScript/JXA is rejected with CHROME_BACKGROUND_REQUIRED in both Relaxed and Strict modes
• direct Chrome executable launches are rejected
• shell open of HTTP/HTTPS URLs is rejected even with open -g, so agent browser tabs cannot bypass the managed MDB group
• both shell_exec and shell_start enforce the rule
• Relaxed mode still removes per-site approval ceremony and still permits non-Chrome foreground app control when genuinely required
• Strict mode continues to add scoped website and non-Chrome foreground-app approvals

This addresses a live regression where another concurrent Mato/Syften workflow bypassed the extension with Chrome AppleScript, created ungrouped tabs, and repeatedly stole foreground focus. After the guard was loaded, that workflow switched to Syften API/feed access instead.

Stop tests from taking down the live bridge

• tests/installer-mock.sh now explicitly overrides MAC_DEV_BRIDGE_UNLOCK_FILE; previously it inherited the real menu-bar unlock path and mock uninstall.sh removed it
• federation disable.sh coverage now uses a temporary fake install directory, preventing fallback process scans from matching the live repo checkout
• verified a complete npm test run leaves both the live unlock file and live bridge PID intact

Preserve contributor checksum contract

• regenerates SHA256SUMS after feat: background Chrome workspace with relaxed approvals #8
• covers exactly all 53 tracked files except the checksum manifest itself
• restores the verification contract introduced by contributor PR test: add poisoned-repository adversarial harness #4

Validation

• npm test — full suite green
• explicit before/after assertion: live MDB PID remained alive and live FULL_ACCESS_ENABLED remained present after the full suite
• node tests/smoke.mjs
• node tests/chrome-background.mjs
• npm run check
• swiftc -typecheck -target "$(uname -m)-apple-macos13.0" -framework AppKit menubar/MenuBarApp.swift
• npm pack --dry-run --json
• shasum -a 256 -c SHA256SUMS — all entries OK
• git diff --check
• live Relaxed-mode probe rejects direct Chrome shell automation with CHROME_BACKGROUND_REQUIRED

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.