feat(extension): per-identity pairing + non-blocking scope growth + connection dot

[chrischall]

Three cohesive changes to @fetchproxy/extension-core's pairing/trust flow, motivated by a real outage: musescore-mcp 0.3.0 added a capability, which force-blocked a re-pair across two concurrent instances and hung the whole bridge. Spec + plan in docs/superpowers/.

🔒 Invariant preserved throughout: granted scope ≤ approved scope; a capability is never granted without an explicit [Grant].

Part A — scope helpers (src/lib/scope.ts)

scopeHash (order-independent), intersectScope, isScopeSubset, plus the same* equality helpers moved out of background.ts (DRY). Pure + unit-tested.

Part 1 — per-identity pairing

pendingPair is now keyed by (identityHash + scopeHash) with an mcpIds[] set (+ sessionNonces map) instead of per-mcpId. Concurrent instances of the same identity+scope collapse into one approval; approving trusts the identity once and replays a session to every waiting mcpId. Legacy pending records migrate on read.

Part 2 — non-blocking scope growth ("update or remain paired")

The hello decision now computes granted = approved ∩ declared and auto-trusts on the intersection instead of blocking when an MCP declares new capabilities. A dismissible scope-update offer ([Grant] / [Keep as is]) is queued; the request handler enforces the granted capability set, so an ungranted verb errors cleanly instead of hanging. [Keep as is] is suppressed (per-identity dismissed scopeHash) until the declared scope changes again. This would have prevented the musescore outage.

Part 3 — connection-status dot (independent)

Each trusted MCP in the popup shows a green/grey presence dot, driven by the set of connected identityHashes (≥1 live session), with live updates via a connections-changed broadcast + get-connected-identities query.

Tests / status

extension-core: 156 passing, tsc -b clean. Branch touches only docs/ + packages/extension-core (no packages/server changes).

Note: packages/server has pre-existing test failures in this environment unrelated to this branch (it doesn't touch server); flagging in case CI surfaces them.

🤖 Generated with Claude Code

[claude]

Claude finished @chrischall's task in 5m 36s —— View job

---

Claude PR Review — complete

• Load tools and read CLAUDE.md
• Read PR diff and changed files
• Review scope helpers (scope.ts + tests)
• Review pending-pair changes (per-identity keying)
• Review background.ts hello/scope-growth/connection-dot logic
• Review popup changes
• Review tests for coverage
• Post inline findings (3 nits) + summary verdict

Summary — verdict: warn

Solid, well-scoped work that wires three cohesive changes (per-identity pairing dedup, non-blocking scope growth, connection-status dot) onto the existing pair flow. The central security invariant — granted = approved ∩ declared, request handler enforces granted — is preserved cleanly: intersectScope returns a deep-copied subset, auto-trust's capabilities field carries only the intersection, and mcpCapabilities.set(...) at background.ts:819 feeds the existing capability gate in handleRequest. Concurrency around pendingPair storage stays correct via withPendingPairLock. Legacy 0.5.1/0.5.2 records migrate cleanly through normalisePendingPair. Test coverage for the new branches looks thorough (Part 2 scope-growth, dismiss suppression, multi-instance collapse, connection-status dot all have dedicated cases).

No 🔴 Important findings — three 🟡 nits posted inline:

• Dead same* helper imports in background.ts:58-68 (residue from refactor; tsc doesn't catch because noUnusedLocals is off).
• A narrow kind: 'pair' vs kind: 'scope-update' key collision at background.ts:960-992 where a needs-pair can be silently dropped if it lands on the same ${identityHash}:${scopeHash} as a queued scope-update (reachable by revoking trust mid scope-update, then a reconnect). The MCP then hangs.
• pendingScopeUpdate.sessionNonce (type at line 173, populated at 361) is never consumed — scope-update is non-blocking and doesn't need a fresh ECDH/ReadyFrame.

Couple of observations for follow-up (not findings):

• dismissedScopeHashes[identityHash] is append-only; over many MCP versions the per-identity list grows unboundedly. Probably fine in practice (small strings, few identities), but worth noting.
• PendingPair interface still lacks localStoragePointers / sessionStoragePointers fields — this is pre-existing, not introduced by this PR, but it does mean pointer adds aren't surfaced in the diff. Worth tackling when extending the scope-update UI.
  • Branch: feat/multi-instance-pairing-and-scope-growth

[claude]

🟡 Nit — unused imports. The five same* helpers (sameCapabilitySet, sameScopeArrays, sameCaptureHeaders, sameIndexedDbScopes, sameStoragePointers) are imported here but never referenced anywhere else in background.ts after the Part 2 refactor — they were used by the old "tighten / widen → needs-pair" path, which is now replaced by intersectScope + isScopeSubset. They're still used inside scope.ts itself (by isScopeSubset), so the export is justified, but the import in this file is dead.

tsc doesn't catch this because the workspace doesn't enable noUnusedLocals. Dropping these from the import list keeps the surface tight.

Suggested change

	import {
	sameCapabilitySet,
	sameScopeArrays,
	sameCaptureHeaders,
	sameIndexedDbScopes,
	sameStoragePointers,
	scopeHash,
	intersectScope,
	isScopeSubset,
	} from './lib/scope.js';
	import { loadOrCreateExtensionIdentity, type ExtensionIdentity } from './extension-identity.js';
	import {
	scopeHash,
	intersectScope,
	isScopeSubset,
	} from './lib/scope.js';

[claude]

🟡 Nit — needs-pair silently dropped when colliding with a scope-update entry at the same key.

The branch only handles two cases — currentEntry.kind === 'pair' and !currentEntry. If currentEntry exists with kind === 'scope-update', neither branch fires and the new needs-pair record is silently lost (no entry written, no pair-pending sent at line 1013 since that's also gated on entry.kind === 'pair'). The MCP then hangs waiting for a ReadyFrame that will never arrive.

Repro sequence (narrow but reachable):

1. Trust exists for identity I with scope S₀.
2. MCP A connects, scope grew → auto-trust with intersection + scope-update queued at key I:hash(S_declared).
3. User revokes trust for I via the popup before deciding the scope-update.
4. MCP A's WS drops and reconnects. Hello → no trust record → needs-pair with key I:hash(S_declared) — same key.
5. Neither branch fires; needs-pair drops.

Suggested fix: if currentEntry.kind === 'scope-update', replace it with the new pair record (the auto-trust path it represented is no longer valid — there's no trust record any more).

[claude]

🟡 Nit — sessionNonce field is dead. pendingScopeUpdate.sessionNonce is populated at line 361 but never read anywhere in the consumer at lines 851-929 (scope-update is a non-blocking offer — no ECDH / ReadyFrame is derived from it, since the session is already live). Safe to drop both the field on the type and the assignment in the result.