[alexey-max-fedorov]

Summary

Chrome Web Store build that runs no remote code. Prodigy loads its own, unmodified game.min.js, and every line of JavaScript Play Origin runs ships inside the extension zip. Nothing is fetched then eval'd, nothing runs through onreset, and no prefix/suffix comes from GitHub.

• Hooks instead of source patches. contents/runtime.ts (MAIN world, document_start) wraps Object.defineProperty to capture webpack export objects as the game creates them. After boot it resolves five targets by shape or by names minification can't touch: the singleton class, the constants object, the EV() component registry, the base action class and the Tower Town service. It then installs the three education bypasses as prototype wraps and builds the window._ API the menu reads. This replaces all six P-NP regex rules; safe-bind and the semaphore guard are no longer needed.
• Packaged menu. originGUI/build.mjs also emits dist/menu.js (startOriginMenu()), and contents/menu.ts bundles it and starts it on origin:ready. Removed from the menu: Update menu, Switch Branch, Eval Console, the dev-socket eval, and the string evals in player/pets.
• Removed from the extension: the background fetch/patch/cache pipeline, the onreset injector and its bridge, the game.min.js block rule, the CSP/XFO strip, the raw.githubusercontent.com host permission, storage/unlimitedStorage, and the popup's manifest/menu URL overrides.
• Prodigy's CSP is left intact. The login background and logo are packaged (web-accessible) and served via DNR extensionPath. The GitHub status-message fetch is dropped, and Teleport zone tiles are labelled by name.

Design: docs/superpowers/specs/2026-09-24-chrome-packaged-runtime-design.md. Plan: docs/superpowers/plans/2026-09-24-chrome-packaged-runtime.md.

⚠️ Merge caution

This branch is the Chrome-only build. Edge and Firefox still run the published P-NP/onreset binaries, which fetch originGUI/dist/bundle.js from master at runtime. Merging this PR updates that file, so those users would lose Update menu, Switch Branch, Eval Console and the status message. Keep this unmerged, or split the originGUI changes out, until Edge/Firefox move off the old pipeline.

Test plan

• cd extension && pnpm test: 33/33 (hook capture, resolvers, bypass gate on/off and idempotency, window._ API incl. lodash replacement and membership restore)
• pnpm build: the prod bundles contain no onreset and no raw.githubusercontent.com, and have 0 eval(/new Function(
• Live on game 2026.46.1 (dev build, Brave): game.min.js 200 from Prodigy, 3× [Origin] hook installed, no missing targets, _.instance.prodigy/constants/player/network/membership resolve, menu starts, Shift toggles it, membership on/off round-trips, packaged logo renders under the page CSP
• Education disabled → battle attack goes through with no question (manual)
• Teleport dialog shows named zone tiles (not clicked through live)
• pnpm package zip uploaded to CWS

Known and deferred: menu fonts (Sen/Arvo) fall back to sans-serif under the CSP; users updating from 4.4.1 keep an orphaned patched-bundle cache in extension storage; pnpm typecheck has one error inherited from master (popup.tsx ./style.css import).

🤖 Generated with Claude Code