feat(extension): add Firefox WebExtension support

- Add a neutral WebExtension API adapter that uses Firefox browser.* or Chromium chrome.* without mutating globals.
- Switch extension runtime code to the adapter and add Firefox-specific typings for tabs, windows, tab groups, storage, scripting, and native messaging ports.
- Fix Firefox temporary add-on instructions to load the packaged manifest with background.scripts instead of the Chromium service worker manifest.
- Detect Firefox in clients.list via runtime.getBrowserInfo and keep Chromium user-agent fallback support.
- Make navigate.open wait briefly for Firefox to replace initial about:blank with the requested URL.
- Add JS coverage for API selection, clients.list browser detection, and Firefox navigate.open URL polling.
- Bump package and extension version to 0.15.2.

extension/src/classes/CommandRegistry.ts

@@ -1,3 +1,4 @@
+import { webExtApi as api } from '../browser-api';
 import { CommandGroup } from './CommandGroup';
 import type { CommandContext, CommandEntry, CommandSpec } from './CommandGroup';
 import { NavigationCommands } from '../commands/navigation';
@@ -74,7 +75,7 @@ export class CommandRegistry {
 /**
  * Builds the registry and registers every command group. The SessionCommands
  * instance is returned alongside because index.ts wires its lifecycle methods
- * (chrome.tabs.onActivated → activateLazyTab) and NativeConnection references it
+ * (api.tabs.onActivated → activateLazyTab) and NativeConnection references it
  * for the clients.rename_profile reconnect side-effect.
  */
 export function assembleRegistry(ctx: CommandContext): { registry: CommandRegistry; session: SessionCommands } {

extension/src/classes/JobManager.ts

@@ -1,7 +1,8 @@
+import { webExtApi as api } from '../browser-api';
 /**
  * Background-job retention helpers + the JobManager that owns the live job map.
  *
- * `pruneFinishedJobs` / `MAX_FINISHED_JOBS` are kept free of chrome.* /
+ * `pruneFinishedJobs` / `MAX_FINISHED_JOBS` are kept free of api.* /
  * service-worker side effects so the retention logic (memory-leak guard) can be
  * unit-tested in isolation.
  */
@@ -16,7 +17,7 @@ export const MAX_FINISHED_JOBS = 20;
 
 // Watchdog: if a runner never resolves/rejects (e.g. executeScript against a
 // dead tab), finalize the job as an error so its persist interval stops instead
-// of writing to chrome.storage.local every second forever.
+// of writing to api.storage.local every second forever.
 export const JOB_TIMEOUT_MS = 5 * 60 * 1000;
 
 /**
@@ -65,11 +66,11 @@ export class JobManager {
     const running = all.filter(job => job.status === "running");
     const finished = all.filter(job => job.status !== "running").slice(-MAX_FINISHED_JOBS);
     const recentJobs = [...running, ...finished].map(({ __timer, __watchdog, ...rest }) => rest);
-    await chrome.storage.local.set({ recentJobs });
+    await api.storage.local.set({ recentJobs });
   }
 
   // Evict the oldest finished jobs once their count exceeds the retention cap.
-  // Recent finished jobs remain queryable via chrome.storage.local (persistJobs)
+  // Recent finished jobs remain queryable via api.storage.local (persistJobs)
   // even after eviction from the in-memory Map.
   private pruneJobs() {
     pruneFinishedJobs(this.jobs, MAX_FINISHED_JOBS);
@@ -143,7 +144,7 @@ export class JobManager {
   async status({ jobId }: { jobId?: string }) {
     const job = this.jobs.get(jobId);
     if (job) return { ...job };
-    const { recentJobs } = await chrome.storage.local.get<{ recentJobs?: Job[] }>("recentJobs");
+    const { recentJobs } = await api.storage.local.get<{ recentJobs?: Job[] }>("recentJobs");
     const stored = (recentJobs || []).find(entry => entry.id === jobId);
     if (!stored) throw new Error(`Job '${jobId}' not found`);
     return stored;

extension/src/classes/NativeConnection.ts

@@ -1,3 +1,4 @@
+import { webExtApi as api } from '../browser-api';
 /**
  * Native-messaging port lifecycle: connect/keepalive/reconnect plus the inbound
  * message router that hands commands to the CommandRegistry.
@@ -6,7 +7,7 @@
 import { getErrorMessage, getProfileAlias } from '../core';
 import type { CommandRegistry } from './CommandRegistry';
 import type { SessionCommands } from '../commands/session';
-import type { ControlMessage, ResponseMessage, IncomingMessage, PageRequest, DispatchArgs, Serializable } from '../types';
+import type { ControlMessage, ResponseMessage, IncomingMessage, PageRequest, DispatchArgs, Serializable, RuntimePort } from '../types';
 
 const NATIVE_HOST = "com.browsercli.host";
 const DEBUG_LOG = false;
@@ -16,7 +17,7 @@ function debugLog(...args: Serializable[]) {
 }
 
 export class NativeConnection {
-  private port: chrome.runtime.Port | null = null;
+  private port: RuntimePort | null = null;
   private keepaliveEnabled = true;
 
   constructor(
@@ -26,17 +27,17 @@ export class NativeConnection {
 
   /** Registers all runtime listeners and opens the initial connection. */
   start() {
-    chrome.runtime.onInstalled.addListener(() => this.connect());
-    chrome.runtime.onStartup.addListener(() => this.connect());
-    chrome.runtime.onSuspend.addListener(() => {
+    api.runtime.onInstalled.addListener(() => this.connect());
+    api.runtime.onStartup.addListener(() => this.connect());
+    api.runtime.onSuspend.addListener(() => {
       this.disconnectPort({ sendBye: true });
     });
-    chrome.windows.onCreated.addListener(() => {
+    api.windows.onCreated.addListener(() => {
       this.keepaliveEnabled = true;
       if (!this.port) this.connect();
     });
-    chrome.windows.onRemoved.addListener(async () => {
-      const windows = await chrome.windows.getAll({});
+    api.windows.onRemoved.addListener(async () => {
+      const windows = await api.windows.getAll({});
       if (windows.length > 0) return;
 
       this.keepaliveEnabled = false;
@@ -46,15 +47,15 @@ export class NativeConnection {
     // Reconnect poll — wakes the worker to re-establish the native port if it
     // dropped. 0.5 min is Chrome's minimum alarm period; lower values (e.g. 0.4)
     // are silently clamped and log a warning, so we set it explicitly.
-    chrome.alarms.create("keepalive", { periodInMinutes: 0.5 });
-    chrome.alarms.onAlarm.addListener((alarm) => {
+    api.alarms.create("keepalive", { periodInMinutes: 0.5 });
+    api.alarms.onAlarm.addListener((alarm) => {
       if (alarm.name === "keepalive") {
         if (!this.port && this.keepaliveEnabled) this.connect();
       }
     });
   }
 
-  private sendControlMessage(targetPort: chrome.runtime.Port | null, message: ControlMessage) {
+  private sendControlMessage(targetPort: RuntimePort | null, message: ControlMessage) {
     if (!targetPort) return;
     try {
       targetPort.postMessage(message);
@@ -63,7 +64,7 @@ export class NativeConnection {
     }
   }
 
-  private sendResponse(targetPort: chrome.runtime.Port | null, message: ResponseMessage) {
+  private sendResponse(targetPort: RuntimePort | null, message: ResponseMessage) {
     if (!targetPort) return;
     try {
       targetPort.postMessage(message);
@@ -90,12 +91,12 @@ export class NativeConnection {
   private async connect() {
     if (this.port || !this.keepaliveEnabled) return;
     try {
-      const nativePort = chrome.runtime.connectNative(NATIVE_HOST);
+      const nativePort = api.runtime.connectNative(NATIVE_HOST);
       this.port = nativePort;
       nativePort.onMessage.addListener((msg: IncomingMessage) => this.onMessage(msg));
       nativePort.onDisconnect.addListener(() => {
         if (this.port === nativePort) this.port = null;
-        const err = chrome.runtime.lastError;
+        const err = api.runtime.lastError;
         if (err) console.warn("[browser-cli] Native host disconnected:", err.message);
       });
       // Send hello so native host knows which profile/alias this is